# SharePoint MCP Servers and Sites.Selected: How to Limit AI to Specific Sites Sites.Selected is a Microsoft Graph permission scope that gives an app access only to the SharePoint sites an administrator grants it. Most SharePoint MCP servers, including the connectors built into Claude and ChatGPT, can't work within it, because SharePoint search and site discovery need Sites.Read.All. This guide covers how the grants work, why the servers fail, and a scoped alternative. Source: https://fast.io/resources/sharepoint-mcp-sites-selected/ Author: [Derek Labian](https://fast.io/authors/derek-labian/) Last reviewed: 2026-10-23 ## Does SharePoint Have an MCP Server? Yes. Microsoft publishes SharePoint MCP servers, and Claude's Microsoft 365 connector is itself an Anthropic-hosted MCP server. The ones that read existing SharePoint sites act as the signed-in user, so they reach whatever that user can open. None of them documents Sites.Selected, the Graph permission that limits an app to granted sites, as a way to narrow that reach. That matters to a regulated team. A deal team may want Claude to read one fund's deal memos and investment committee materials and nothing else, which is narrower than everything each analyst can open. ### Work IQ MCP and the SharePoint MCP server in Copilot Studio Work IQ MCP is Microsoft's MCP endpoint for Microsoft 365 data, including files and sites. Microsoft describes it as generally available, billed through usage-based Copilot Credits and independent of Microsoft 365 Copilot licensing; enabling it requires a usage-based billing plan in Copilot Studio with an Azure subscription. Its actions are user scoped, so every request accesses only what that user is allowed to see. Microsoft documents connections from Copilot Studio, Microsoft Foundry and GitHub Copilot CLI. Copilot Studio also lists a workload-specific SharePoint MCP server in preview, which also appears as the Work IQ SharePoint MCP (Preview) Premium connector. Its tools include `findSite`, `listDocumentLibrariesInSite`, `getFolderChildren` and `readSmallTextFile`; `findFileOrFolder` searches every site and library the user can reach, and file operations are limited to files of 5 MB or less. Microsoft says these application-specific tools exist for backward compatibility and shouldn't be used in production or new projects. In Copilot Studio, Work IQ's workload selection covers whole workloads such as SharePoint and can't select individual sites. ### SharePoint Embedded MCP server The SharePoint Embedded MCP server is an open-source developer tool in preview, the `@microsoft/spe-mcp` npm package. It runs locally with Claude Desktop, Claude Code, Codex CLI, Cursor or GitHub Copilot in Visual Studio Code, and it sets up and manages SharePoint Embedded applications and their containers. Its content tools work on files in those containers; Microsoft doesn't describe it as a way to reach existing SharePoint team sites. Its "Control what the server can do" section covers a read-only mode, tool profiles and a separate consent before content tools can touch files. ### Community and hosted servers Open-source SharePoint MCP servers on GitHub call Microsoft Graph or the SharePoint REST API through an Entra ID app registration that you create and consent to. Hosted integration platforms offer SharePoint as one connector among many and run the server for you. Either way, the permissions on the app registration behind the server decide what the AI can reach, which is where Sites.Selected comes in. ## What Is Sites.Selected? Sites.Selected is a Microsoft Graph API permission that gives an app no SharePoint access at all until an administrator grants it a role on a specific site collection. That inverts the `.All` permissions: once an administrator consents to `Sites.Read.All`, the app can read documents and list items in all site collections, with no further step. Microsoft now documents four Selected scopes for SharePoint and OneDrive: | Scope | What it can be granted on | | --- | --- | | `Sites.Selected` | A whole site collection | | `Lists.SelectedOperations.Selected` | A specific list or library | | `ListItems.SelectedOperations.Selected` | List items, folders and files | | `Files.SelectedOperations.Selected` | Files or library folders | Sites.Selected came first and works only at the site collection level. The three newer scopes extend the model down to lists, folders and single files, and Microsoft notes that the longer names follow newer naming rules with no functional difference. Microsoft lists three conditions, and the app has no access if any one is missing: 1. The app is consented in Microsoft Entra ID for the Selected scope. 2. The app is granted a role on the resource through that resource's `/permissions` endpoint. 3. The app acquires a token that contains the Selected scope when it calls the resource. ## Sites.Selected Permission Types and Roles Sites.Selected comes in two permission types, application and delegated, and a grant carries one of four roles. Microsoft's overview says every Selected scope now supports both types. - **Application (app-only):** the app calls Microsoft Graph with its own identity and no signed-in user. Microsoft calls this the higher-risk mode because no user is present. - **Delegated:** the app acts for a signed-in user, and the user's own permissions still apply. Microsoft's permissions reference marks admin consent as required for the application form of every Selected scope, and for the delegated form of every one except Sites.Selected. A site grant doesn't name a permission type. Microsoft's developer blog explains that the token request decides it, and that consenting only the delegated form of Sites.Selected blocks app-only calls, so a user is always present. Microsoft documents delegated Sites.Selected as a Microsoft Graph permission. Its resource-specific consent guide mentions a Sites.Selected application permission for the SharePoint REST API, but not a delegated one, so build delegated designs on Graph. The roles are `read`, which reads the metadata and contents of the resource, and `write`, which reads and modifies them. Microsoft's Graph overview lists owner and full control as the higher roles, while its resource-specific consent guide and PnP PowerShell use manage and full control. An app that only reads documents for an AI needs `read`. ## How to Grant Sites.Selected With Microsoft Graph and PnP PowerShell You grant SharePoint Sites.Selected access with a POST to the site's `/permissions` endpoint in Microsoft Graph, or with the PnP PowerShell cmdlet `Grant-PnPEntraIDAppSitePermission`. Either way, the person or app making the grant needs far more privilege than the AI app will hold. ### Microsoft Graph This request grants an app read access to one site: ```http POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions Content-Type: application/json { "roles": ["read"], "grantedToIdentities": [{ "application": { "id": "{app-client-id}", "displayName": "Deal team AI connector" } }] } ``` A successful call returns `201 Created` with a permission object: ```http HTTP/1.1 201 Created Content-Type: application/json { "id": "{permission-id}", "roles": ["read"], "grantedToIdentitiesV2": [{ "application": { "id": "{app-client-id}", "displayName": "Deal team AI connector" } }] } ``` Keep the `id` to read, update or delete the grant later at `/sites/{site-id}/permissions/{permission-id}`. Microsoft's example also returns the older `grantedToIdentities` property, marked as deprecated. Microsoft's reference lists `Sites.FullControl.All` as the only permission that can create a site grant; in delegated mode the caller must also be a SharePoint Administrator or higher and a member of the target site. Grants below the site level need less: `Sites.Selected` with a full control or owner role on the parent site, or, for items and files, `Lists.SelectedOperations.Selected` with that role on the parent list. ### PnP PowerShell The current cmdlet is `Grant-PnPEntraIDAppSitePermission`. The name many guides still use, `Grant-PnPAzureADAppSitePermission`, is now an alias for it. The cmdlet takes Read, Write, Manage or FullControl, and PnP's reference lists Microsoft Graph `Sites.FullControl.All`, delegated, as the permission it needs. ```powershell Grant-PnPEntraIDAppSitePermission -AppId "{app-client-id}" -DisplayName "Deal team AI connector" -Permissions Read -Site "https://contoso.sharepoint.com/sites/fund-deals" ``` `Get-PnPEntraIDAppSitePermission` lists the grants on a site, `Set-PnPEntraIDAppSitePermission` changes a grant's role, and `Revoke-PnPEntraIDAppSitePermission -PermissionId {permission-id}` removes it. For the certificate-based app registration behind app-only access, see [SharePoint app-only authentication](/resources/sharepoint-app-only-authentication/). ### Consent behavior to plan around - Revoking a scope's consent in Entra ID removes access to everything granted under that scope. A grant made under another Selected scope, such as a list grant under `Lists.SelectedOperations.Selected`, keeps working. - Deleting a list grant removes access to the list and every item in it, regardless of item-level grants. - A grant on a list, folder or file breaks permission inheritance on that item, and SharePoint limits unique permissions per list or library. Site collection grants don't. If content is organized by deal folder, folder grants mean maintaining unique permissions as deals open and close. ## How Access Is Calculated With Delegated Sites.Selected With delegated Sites.Selected, SharePoint calculates the app's grant and the user's own permissions and uses the intersection. Microsoft states it both ways: the app can never exceed the user's permissions, and the user can never exceed the app's grant through the app. App-only calls involve no user: SharePoint allows the call if the app's grant on the resource, or on a parent it inherits from, covers the operation. The delegated rule is the one an AI rollout wants. Take an analyst who can open 40 SharePoint sites, using an AI app that has read grants on the two sites for one fund. Through that app, the analyst's AI reaches only those two sites, and only the parts of them the analyst can already open. Remove the analyst from a site and the AI loses it too; remove the app's grant and every user loses it through the app. The catch: Claude's and ChatGPT's connectors don't use it, and the search calls an AI depends on don't accept it, as the next section explains. ## Why SharePoint MCP Servers Break With Sites.Selected SharePoint MCP servers break with Sites.Selected when their tools search for a document or list sites, because those Graph endpoints need `Sites.Read.All` or `Files.Read.All`. ### The built-in connectors don't accept it Anthropic's security guide for the Microsoft 365 connector says SharePoint search requires `Sites.Read.All`, and that site-specific permissioning with `*.Selected` permissions isn't supported because the underlying search is tenant-wide. It also lists service principal authentication as unsupported. For the consent setup the connector does use, see [Claude SharePoint permissions](/resources/claude-sharepoint-permissions/). OpenAI's SharePoint setup article lists Sites.Selected as not supported for live SharePoint search and asks admins to enable `Sites.Read.All` and `Files.Read.All`. ### Search and site discovery need .All permissions If a self-hosted or third-party server's tools start by searching or listing sites, they hit the calls Microsoft's reference pages flag: | What the MCP tool calls | What Microsoft's reference says | | --- | --- | | `GET /sites?search={query}` to find a site | Doesn't support the Sites.Selected application permission | | `GET /drives/{drive-id}/root/search(q='{text}')` to find a file | Doesn't support the Sites.Selected application permission | | `GET /sites/getAllSites` to list every site | Application permissions only, with `Sites.Read.All` as the least privileged | | `POST /search/query` (Microsoft Search API) | Application access lists `Files.Read.All` or `Sites.Read.All`; no Selected scope appears | A tool built on these calls fails at its first step, even when the site grant is correct. ### What works, and what it costs Microsoft's resource-specific consent guide says calls to a granted site succeed and calls to any other site collection fail with "Access denied." So a server given the site ID or path up front can walk that site's libraries and folders. It gives up search: the model browses by path, or you host your own index of the granted content. For the Graph calls, see the [Microsoft Graph API guide for SharePoint](/resources/microsoft-graph-api-sharepoint/). Three other things to check: - **A grant for every site.** Consent alone gives the app nothing until each site is granted. - **The scope in the token.** A grant applies only when the token contains the Selected scope, so check both the permissions consented in Entra ID and the scopes the server requests. - **App-only means one reach for everyone.** An application token carries no user, so everyone using that server reaches whatever the app was granted. A delegated design keeps each user's permissions but needs a sign-in and token exchange per user, which is a full application to build and maintain. ## SharePoint MCP Options Compared Each option draws the line in a different place: | Option | What decides what the AI sees | Narrower than the user's own access | Folder-level scope | | --- | --- | --- | --- | | Claude Microsoft 365 connector | The user's SharePoint permissions, searched tenant-wide | No | No | | ChatGPT SharePoint app with site-collection allowlist | The user's permissions plus an OpenAI-enforced allow or deny list | Yes, by whole site collection | No | | Work IQ MCP and the Copilot Studio SharePoint server | The user's permissions and Microsoft 365 policy | Not by site; Copilot Studio selects whole workloads | No | | Custom SharePoint MCP server with Selected scopes | App grants per site, list, folder or file | Yes in delegated mode; in app-only mode the grants apply to every user | Yes, and each grant breaks inheritance | | Scoped Fastio workspace | Workspace membership and the workspaces chosen at sign-in | Yes; access follows workspace membership, not SharePoint permissions | Yes, by choosing which folders each workspace receives | ChatGPT's site controls need workspace enablement and apply to whole site collections, not subsites, folders or files. That may be enough if each deal has its own site collection, but not if deals are folders in a shared library. Restricted Content Discovery keeps a site out of organization-wide search and Microsoft Copilot responses without changing permissions, and Restricted SharePoint Search is retiring, with new enablement blocked since July 31, 2026. Neither Anthropic nor OpenAI lists them as controls for their connectors. ## Limit Claude or ChatGPT to Selected SharePoint Content With a Scoped Workspace A scoped workspace limits Claude or ChatGPT by giving it a separate copy of only the SharePoint folders it may read. With Fastio, SharePoint stays where it is and each scope becomes its own [workspace](/product/workspaces/). 1. **Create a workspace per scope,** such as one per deal team, fund or finance group. Fastio permissions are set per organization, workspace and share, with no folder- or file-level permissions inside a workspace, so the workspace is the boundary. 2. **Link SharePoint through Cloud Sync.** An owner who can open the libraries links OneDrive for Business in Cloud Sync, which reaches SharePoint libraries through the OneDrive connector. The connection uses OAuth, the owner picks the library and folders, and folder structure is preserved. 3. **Choose how the content stays current.** - A one-time import copies the folders once. - A one-way sync keeps the Fastio copy current from SharePoint and never writes to SharePoint. - A two-way sync also carries changes made in Fastio back to SharePoint. 4. **Add members.** Workspace membership now decides who can reach the content, so add only the people who should see it. SharePoint permissions still govern SharePoint itself. 5. **Connect Claude or ChatGPT over MCP.** Add Fastio as a custom connector at `https://mcp.fast.io/mcp/tools` for Claude and most clients, or `https://mcp.fast.io/mcp/operations` for ChatGPT; steps are on [mcp.fast.io/docs](https://mcp.fast.io/docs). Each person signs in with OAuth in the browser, so the configuration holds no API key. On the Review Permissions screen, choose **Read Only** and select only the workspaces this connection may reach. Read Only connections aren't offered tools that change data. 6. **Give headless agents a scoped API key.** Code without a person sends `Authorization: Bearer your-api-key` to `https://mcp.fast.io/mcp/tools` or `https://mcp.fast.io/mcp/code`, and the key can be scoped to specific organizations, workspaces or shares. Syncs run on a recurring schedule or on demand, not continuously, so expect a delay between an edit in SharePoint and the AI seeing it. For Claude Code specifically, see [Claude Code SharePoint MCP](/resources/claude-code-sharepoint-mcp/). ### Close the other route A scoped workspace limits the AI only if it is the only route. If the same users also have Claude's Microsoft 365 connector or ChatGPT's SharePoint app, the AI can still reach everything they can open in SharePoint. In Claude, Team and Enterprise owners decide whether to enable that connector, and an Entra administrator can set **Assignment required** on both Claude enterprise applications. In ChatGPT, workspace admins manage app availability and role access. To revoke a Fastio connection, remove the connector in the AI client, then open Settings, Devices & Agents, Connected Devices in Fastio and select Revoke. Fastio indexes imported files for search, summarization and chat (Intelligence), so Claude can search a workspace instead of browsing by path. Intelligence can be turned off per workspace, but not turned back on. The built-in assistant, Ripley, is optional; your own Claude or ChatGPT can do the work. ## Governance and Cost Fastio governs access by organization, workspace and share, and meters AI work in credits on top of a plan price. Every workspace member sees its contents according to their role, and a share gives an outside party, such as a lender's counsel, a subset of files without workspace membership. The Enterprise plan adds administrative policies, legal holds, security alerts and a SIEM audit stream. Fastio's detailed activity log records changes such as uploads, edits, moves and deletions, plus permission and membership changes. It doesn't record views, opens or downloads, so don't plan on it as a record of who read a file. The Enterprise plan costs $199.99 a month or $1,999 a year and includes 30 seats, with extra seats at $1 per seat per month up to 200, plus 25 TB of storage, 3,000,000 credits a month and 200 workspaces. Starter costs $9.99 a month with 3 seats and 5 workspaces, and Business $49.99 a month with 10 seats and 50 workspaces; since each scope is a workspace, that count matters. Credits pay for AI work: chat, file ingestion and indexing, agent runs and document processing. Storage, bandwidth and seats come with the plan and aren't charged in credits. Credit overage is $10 per 100,000 credits. Monthly plans can be trialed for up to 14 days or until the included trial credits run out, whichever comes first; a card is required, and annual plans have no trial. See [pricing](/pricing/) for current details. ## Rollout Checklist 1. **List the scopes.** For each AI use case, write down the people and the SharePoint folders the AI may read, such as active deal memos or the controllers' close files. 2. **Create one workspace per scope** and add only the people in that scope. 3. **Link OneDrive for Business in Cloud Sync** from an owner account that can open those libraries, pick the folders, and choose one-way sync when SharePoint must stay unchanged. 4. **Connect Claude or ChatGPT to Fastio** with OAuth, choose Read Only, and select only that person's scoped workspaces. Give headless agents a scoped API key. 5. **Turn off or unassign the native SharePoint connector** for these users so the scoped workspace is the only route. 6. **Test with a real account.** Ask the AI for a document inside the scope and one outside it, and confirm it finds only the first. 7. **Review membership when a deal closes or a team changes**, and revoke connections under Settings, Devices & Agents, Connected Devices when someone leaves. ## Frequently asked questions ### Does Microsoft have an MCP server for SharePoint? Yes. Work IQ MCP is Microsoft's MCP endpoint for Microsoft 365 data, including SharePoint, billed through usage-based Copilot Credits. Copilot Studio also lists a SharePoint MCP server in preview, kept for backward compatibility. The SharePoint Embedded MCP server is a separate open-source tool for SharePoint Embedded containers. ### What is Work IQ SharePoint MCP? It is the connector listing for Microsoft's SharePoint MCP server in Copilot Studio, Power Apps and Power Automate, where it is a Premium connector in preview. Its tools find the sites a user can access, list document libraries, browse folders and read files under 5 MB. Microsoft recommends Work IQ MCP for new projects. ### How do I connect Claude Code to a SharePoint MCP server? Claude Code adds MCP servers with claude mcp add, which Microsoft documents for its SharePoint Embedded MCP server. To reach selected SharePoint folders instead, sync them into a Fastio workspace, add https://mcp.fast.io/mcp/code with claude mcp add, and run /mcp to sign in. The Claude Code SharePoint MCP guide has the full steps. ### What is the difference between Sites.Selected and Sites.Read.All? Sites.Read.All lets an app read documents and list items in all site collections as soon as it is consented. The Sites.Selected permission gives the app no access until an administrator grants it a role, such as read or write, on a specific site collection. In delegated mode, both are still limited by the signed-in user's own permissions. ### Does Sites.Selected work with Microsoft Search? Not for search. Microsoft's reference says site search and drive search don't support the Sites.Selected application permission, and the Microsoft Search API lists Files.Read.All or Sites.Read.All for application access. An app with Sites.Selected can still read a granted site by its ID or path. ### Can I limit Claude to one SharePoint site? Not with Claude's Microsoft 365 connector, which searches the whole tenant with the user's permissions. You can build a SharePoint MCP server with a Sites.Selected grant on that site that browses it by path, or sync that site's library into a Fastio workspace and connect Claude to only that workspace, Read Only. ### Does Sites.Selected work with ChatGPT's SharePoint connector? No. OpenAI lists Sites.Selected as not supported for live SharePoint search. ChatGPT instead offers an allowlist or deny list of whole site collections, which needs workspace enablement and can't limit access to a subsite, folder or file. ### Does a one-way sync change anything in SharePoint? No. A one-way sync keeps the Fastio copy current from SharePoint and never writes to SharePoint. It runs on a recurring schedule or on demand, not continuously. Choose a two-way sync only if changes made in Fastio should flow back. ## Sources - [Microsoft Learn: Work IQ overview](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/work-iq/): Work IQ MCP exposes Microsoft 365 data to agents through MCP, and every request runs in the context of a specific user. - [Microsoft Learn: Work IQ overview](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/work-iq/): Work IQ API access is independent of Microsoft 365 Copilot licensing and available through usage-based billing. - [Microsoft Learn: Enable your tenant for Work IQ](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/work-iq/enable-work-iq): Enabling Work IQ requires a usage-based billing plan in Copilot Studio with an Azure subscription and resource group assigned. - [Microsoft Learn: Understand MCP server options in Agent 365](https://learn.microsoft.com/en-us/microsoft-agent-365/tooling-servers-overview): Work IQ MCP is generally available as part of the Work IQ API, and the workload-specific SharePoint MCP server is retained for backward compatibility. - [Microsoft Learn: Work IQ in Microsoft Copilot Studio](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/add-work-iq): Work IQ workload selection in Copilot Studio is limited to whole workloads and can't select individual sites. - [Microsoft Learn: SharePoint reference (preview), Microsoft Copilot Studio](https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-sharepoint-tools): The Copilot Studio SharePoint MCP server is in preview, offers tools such as findSite, listDocumentLibrariesInSite, getFolderChildren and readSmallTextFile, and limits file operations to files of 5 MB or less. - [Microsoft Learn: Work IQ SharePoint MCP connector](https://learn.microsoft.com/en-us/connectors/workiqsharepoint/): Work IQ SharePoint MCP (Preview) is a Premium connector in Copilot Studio, Power Apps and Power Automate. - [Microsoft Learn: Use the MCP server to build apps with a coding agent](https://learn.microsoft.com/en-us/sharepoint/dev/embedded/build/sharepoint-embedded-mcp-server): The SharePoint Embedded MCP server is an open-source preview developer tool for SharePoint Embedded applications that runs locally and supports clients including Claude Desktop, Claude Code and Cursor, with a read-only mode and tool profiles. - [Microsoft Learn: Overview of Selected permissions in OneDrive and SharePoint](https://learn.microsoft.com/en-us/graph/permissions-selected-overview): Selected scopes cover site collections, lists, list items, folders and files, support delegated and application modes, and give no access until consent, a grant and a token with the scope are all in place. - [Microsoft Learn: Overview of Selected permissions in OneDrive and SharePoint](https://learn.microsoft.com/en-us/graph/permissions-selected-overview): In delegated mode, the app's and the user's permissions are intersected; grants below the site level break inheritance; and the consent behavior notes govern revocation. - [Microsoft 365 Developer Blog: SharePoint now supports delegated Sites.Selected authentication](https://devblogs.microsoft.com/microsoft365dev/sharepoint-now-supports-delegated-sites-selected-authentication/): Delegated Sites.Selected uses the same site permissions assignment, and consenting only the delegated option blocks application-only calls. - [Microsoft Learn: Create permission (site)](https://learn.microsoft.com/en-us/graph/api/site-post-permissions): Creating a site permission requires Sites.FullControl.All, and in delegated mode the user must be a SharePoint Administrator or higher and a member of the target site. - [Microsoft Learn: Microsoft Graph permissions reference](https://learn.microsoft.com/en-us/graph/permissions-reference): Sites.Read.All reads documents and list items in all site collections; Sites.Selected requires admin consent as an application permission but not as a delegated permission. - [Microsoft Learn: Understanding Resource Specific Consent for Microsoft Graph and SharePoint Online](https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins-modernize/understanding-rsc-for-msgraph-and-sharepoint-online): A Sites.Selected app can use a granted site and gets Access denied on other site collections; a Sites.Selected application permission also exists for the SharePoint REST API. - [PnP PowerShell: Grant-PnPEntraIDAppSitePermission](https://pnp.github.io/powershell/cmdlets/Grant-PnPEntraIDAppSitePermission.html): Grant-PnPEntraIDAppSitePermission grants an Entra ID app Read, Write, Manage or FullControl on a site and is used with Sites.Selected. - [PnP PowerShell: Grant-PnPAzureADAppSitePermission](https://pnp.github.io/powershell/cmdlets/Grant-PnPAzureADAppSitePermission.html): Grant-PnPAzureADAppSitePermission is an alias for Grant-PnPEntraIDAppSitePermission. - [Microsoft Learn: Search for sites](https://learn.microsoft.com/en-us/graph/api/site-search): Searching for sites does not support the Sites.Selected application permission. - [Microsoft Learn: Search for files](https://learn.microsoft.com/en-us/graph/api/driveitem-search): Searching for files in a drive does not support the Sites.Selected application permission. - [Microsoft Learn: sites getAllSites](https://learn.microsoft.com/en-us/graph/api/site-getallsites): Listing all sites with getAllSites supports application permissions only, with Sites.Read.All as the least privileged. - [Microsoft Learn: searchEntity query](https://learn.microsoft.com/en-us/graph/api/search-query): The Microsoft Search API query method lists Files.Read.All or Sites.Read.All for application access. - [Microsoft Learn: Restrict discovery of SharePoint sites and content](https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery): Restricted Content Discovery limits discovery in organization-wide search and Microsoft Copilot and does not change permissions. - [Microsoft Learn: Restricted SharePoint Search](https://learn.microsoft.com/en-us/sharepoint/restricted-sharepoint-search): Restricted SharePoint Search is retiring, and new enablement is blocked starting July 31, 2026. - [Claude Help Center: Microsoft 365 connector security guide](https://support.claude.com/en/articles/12684923-microsoft-365-connector-security-guide): Claude's Microsoft 365 connector uses delegated permissions, SharePoint search requires Sites.Read.All, Selected permissions are not supported because search is tenant-wide, and service principal authentication is not supported. - [Claude Help Center: Set up the Microsoft 365 connector](https://support.claude.com/en/articles/12542951-set-up-the-microsoft-365-connector): Owners enable the Claude Microsoft 365 connector, and Assignment required on both Claude enterprise applications limits who can connect. - [OpenAI Help Center: SharePoint app and setup in ChatGPT](https://help.openai.com/en/articles/12143177-sharepoint-app-and-setup-in-chatgpt): ChatGPT's SharePoint app requires Sites.Read.All and Files.Read.All for live access and does not support Sites.Selected for live SharePoint search. - [OpenAI Help Center: Managing SharePoint site access and sensitivity-label exclusions](https://help.openai.com/en/articles/20001502-managing-sharepoint-site-access-and-sensitivity-label-exclusions): ChatGPT's site-collection allowlist and deny list require workspace enablement, apply to whole site collections, and cannot limit access to a subsite, folder or file. ## About Fast.io Fast.io provides shared workspaces where people and AI agents work on the same files, with built-in semantic search and citation-backed chat over what they hold. Agents reach it through a remote MCP server, a REST API at https://api.fast.io/current/, and a command line client published on npm as @vividengine/fastio-cli. MCP setup is at https://mcp.fast.io/docs: Claude and most MCP clients connect to https://mcp.fast.io/mcp/tools, ChatGPT to https://mcp.fast.io/mcp/operations, and coding agents to https://mcp.fast.io/mcp/code.