Azure Function's Identity to Read/Write to SharePoint Online

We have an Azure Function that runs on a scheduled basis, and we have enabled its managed identity. Using this identity, we’ve successfully integrated the function with both Azure SQL Database and Azure Key Vault by assigning the necessary permissions.

We are now looking to integrate the same Azure Function with SharePoint Online, to enable read and write operations to specific site. Is it possible to assign the Azure Function’s managed identity access to SharePoint, similar to how we did with Azure SQL and Key Vault? Or I need to create a separate app registration and use its clientID, TenantId & secret to be able to access SharePoint from Azure Fucntion?

You can refer to MSDOC to grant access the Sharepoint access to Function app's managed identity.

Workaround 1

1. Navigate to function app => enable "System Managed" identity and make a note of the Principal ID:

   

   Use below Azure CLI commands to grant the function app's managed identity the app-only permission Sites.Selected on the SharePoint API:

   managedIdentityObjectId="<Principal_ID>" # principal ID of the managed identity
   resourceServicePrincipalId=$(az ad sp list --query '[].[id]' --filter "displayName eq 'Office 365 SharePoint Online'" -o tsv)
   resourceServicePrincipalAppRoleId="$(az ad sp show --id $resourceServicePrincipalId --query "appRoles[?starts_with(value, 'Sites.Selected')].[id]" -o tsv)"
   
   az rest --method POST --uri "https://graph.microsoft.com/v1.0/servicePrincipals/${managedIdentityObjectId}/appRoleAssignments" --headers 'Content-Type=application/json' --body "{ 'principalId': '${managedIdentityObjectId}', 'resourceId': '${resourceServicePrincipalId}', 'appRoleId': '${resourceServicePrincipalAppRoleId}' }"
   

Workaround 2

Create an Azure AD App Registration for the function app's Managed Identity and grant the necessary permissions to that app in SharePoint Online.

Thanks for the insights @Sedat SALMAN.

• Create a new App Registration => note the Client ID and Tenant ID
• Go to SharePoint Online => Site permissions => Advanced permissions settings => Assign necessary permissions => Select Users => add Client_id@Tenant_id.
• Open Azure function app => update the configuration to use the App Registration's client ID and Tenant ID for SharePoint Online Authentication.
• Use SharePoint Online REST API or Microsoft Graph API to access SharePoint Online resources by authenticating with the App Registration's credentials.