This article covers exclusively the limited-rights version of the Power-user SharePoint Connector.

The article for the standard version of the Connector can be found here.

Overview

Limited-rights mode lets Power-user download files only from the SharePoint sites your IT team explicitly lists, instead of from every site your users can access.

Use limited-rights mode when your security policy does not allow a third-party app to read all SharePoint sites. Power-user never stores or sees your files: they are downloaded to the user's machine on the user's behalf.

Power-user signs in as the user (delegated permission). A file downloads only when both conditions are true: the site is granted to the limited-rights app, and the user can open the file in SharePoint.

TABLE OF CONTENTS

• Overview
• Prerequisites
• Step 1 – Grant admin consent to the limited-rights app
• Step 2 – Register a PnP PowerShell app in your tenant (one-time)
• Step 3 – Grant read access to each SharePoint site
• Step 4 – Verify, update or revoke site access

Prerequisites

Before starting, you should contact Power-user to ask that your account be switched to the limited rights version of the SharePoint connector.

Then you will need the following before you start:

• A Global Administrator (or Privileged Role Administrator) to grant admin consent in Step 1 and Step 2.
• A SharePoint Administrator to run the PowerShell commands in Steps 3 and 4. The account must be able to sign in to each site it grants.
• PowerShell 7.4 or later (tested with 7.6) on a Windows, macOS or Linux machine (download).
• The PnP.PowerShell module (tested with 3.4.1), installed once with:

Install-Module -Name PnP.PowerShell -Scope CurrentUser

Step 1 – Grant admin consent to the limited-rights app

A Global Administrator opens the consent link below once; this adds "Power-user connector (limited rights)" to your Enterprise applications with the delegated Sites.Selected permission only.

1. Replace <yourdomain.com> with your verified domain and open the link in a browser:

https://login.microsoftonline.com/<yourdomain.com>/adminconsent?client_id=bd8bd440-0424-41f0-a102-2b9f8999eabf&scope=https://graph.microsoft.com/.default&redirect_uri=https://www.powerusersoftwares.com/sharepoint-connector-microsoft-entra

2. If your domain is not verified, use your tenant ID instead of the domain (Entra admin center > Overview > Tenant ID).
3. Sign in with the administrator account and select Accept.
4. The browser then opens the Power-user page "SharePoint Connector Microsoft Entra". The consent is saved.
5. Check the result in Entra admin center > Enterprise applications > "Power-user connector (limited rights)" > Permissions. The Admin consent tab lists Microsoft Graph Sites.Selected, type Delegated, with openid, profile and offline_access.

At this point the app can reach no site at all. Access is granted site by site in Step 3.

Optional check from PowerShell, with the Microsoft Graph PowerShell module:

Install-Module Microsoft.Graph.Applications -Scope CurrentUser
Connect-MgGraph -TenantId "<tenant ID>" -Scopes "Application.Read.All" -UseDeviceCode
$sp = Get-MgServicePrincipal -Filter "appId eq 'bd8bd440-0424-41f0-a102-2b9f8999eabf'"
Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id | Select-Object ConsentType, Scope

Expected result: one line with ConsentType AllPrincipals and Scope offline_access openid profile Sites.Selected. No application permission is listed.

Step 2 – Register a PnP PowerShell app in your tenant (one-time)

PnP PowerShell needs its own app registration in your tenant to sign you in; skip this step if your IT team already has one with the Microsoft Graph Sites.FullControl.All delegated permission.

1. Open PowerShell 7 and run, replacing the tenant name:

Register-PnPEntraIDAppForInteractiveLogin -ApplicationName "PnP.PowerShell" `
  -Tenant contoso.onmicrosoft.com `
  -GraphDelegatePermissions "Sites.FullControl.All"

2. A sign-in window opens. Sign in with the administrator account and accept the consent prompt. This consent covers only the signed-in administrator: if another administrator runs Steps 3 and 4, a Global Administrator selects Grant admin consent in Entra admin center > App registrations > PnP.PowerShell > API permissions.
3. Copy the ClientId printed at the end. You use it in Steps 3 and 4.

Expected result:

App PnP.PowerShell with id <ClientId> created.
App created. You can now connect to your tenant using Connect-PnPOnline -Url <yourtenanturl> -ClientId <ClientId>

Sites.FullControl.All is required by Microsoft to grant site-level permissions to another app (PnP documentation). It is delegated: it only works while an administrator is signed in, and Power-user never uses this app.

This one permission is enough. Connect-PnPOnline and all four site-permission commands in Steps 3 and 4 work with it. No SharePoint (AllSites.*) permission is needed, and the command adds none.

Step 3 – Grant read access to each SharePoint site

A SharePoint Administrator runs two commands per site; Read is the only permission Power-user needs.

1. Connect to the site, using the ClientId from Step 2:

Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/Templates" `
  -Interactive -ClientId "<ClientId from Step 2>"

A sign-in window opens. The command prints nothing when it succeeds.

2. Grant the limited-rights app read access to that site:

Grant-PnPEntraIDAppSitePermission `
  -AppId "bd8bd440-0424-41f0-a102-2b9f8999eabf" `
  -DisplayName "Power-user connector (limited rights)" `
  -Permissions Read `
  -Site "https://contoso.sharepoint.com/sites/Templates"

Expected result:

Id    : <PermissionId>
Roles : {read}
Apps  : {Power-user connector (limited rights), bd8bd440-0424-41f0-a102-2b9f8999eabf}

3. Repeat 1 and 2 for every site in your list.

Grant the site that hosts the files, not a sub-folder: permissions apply to the whole site collection.

Step 4 – Verify, update or revoke site access

Check each site once after Step 3; the same commands let you change or remove access later.

Connect to the site first, as in Step 3. Without -Force, Revoke asks for confirmation. Granting the site again after a revoke gives back the same PermissionId.

When these steps are finalized, the administrator of your Power-user licenses can use the administration portal to connect files from the listed SharePoint sites to their Library.