> For the complete documentation index, see [llms.txt](https://atlas.anywhere.now/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://atlas.anywhere.now/set-up-dialogue-cloud-neo/prerequisites/configure-sharepoint-sites/sites-selected-permissions.md). # Sites.Selected permission model Deploy Dialogue Cloud UCC sites in environments where Sites.FullControl.All cannot be granted. Uses Microsoft's Sites.Selected permission scope with a site collection app catalog and subsite model. {% hint style="info" %} This guide is for environments where the deployment app **cannot** be granted `Sites.FullControl.All`. If your Entra ID app has `Sites.FullControl.All`, use the [standard deployment guide](/set-up-dialogue-cloud-neo/prerequisites/configure-sharepoint-sites.md) instead. This model requires UCC Site Creator **v8.4.1.9 or higher** and uses the site collection with subsites model. {% endhint %} Dialogue Cloud supports a reduced-permission deployment path using Microsoft's `Sites.Selected` permission scope. This scope limits the app's access to only the explicitly granted site collection, rather than all sites in the tenant. The model separates responsibilities into two roles: | Role | Responsibility | | ---------------------------- | ----------------------------------------------------------- | | **SharePoint Administrator** | One-time environment preparation (Parts 1 and 2) | | **Delegated Engineer** | All ongoing UCC provisioning and management (Part 3 onward) | Once the administrator completes the one-time setup, they are not required for any subsequent operations. *** ## Prerequisites * An Entra ID application registered with: * `SharePoint — Sites.Selected` (Application permission) * `Microsoft Graph — Sites.Selected` (Application permission) * A certificate (`.pfx`) associated with the Entra ID application * PowerShell 7.4.6 or higher * UCC Site Creator package **v8.4.1.9 or higher** {% hint style="info" %} You may be able to add `Sites.Selected` to an existing Entra ID app from a previous Dialogue Cloud installation rather than registering a new one. {% endhint %} *** ## Part 1 — SharePoint Administrator: create the root site collection The engineer's `Sites.Selected` app cannot create site collections. A SharePoint Administrator must create the root site manually. 1. Go to `https://-admin.sharepoint.com`. 2. Navigate to **Sites** → **Active sites** → **Create**. 3. Choose **Communication site**. 4. Set the URL to the intended UCC root — for example, `https://.sharepoint.com/sites/`. 5. Complete the creation and wait for provisioning to finish. *** ## Part 2 — SharePoint Administrator: enable app catalog and grant permissions These steps require a SharePoint Administrator, or an equivalent operator with authority to create the site collection app catalog and grant app access at the site-collection level. Use a separate admin-run Entra ID app or client ID with the required tenant-level permissions for the `Connect-PnPOnline` session. The engineer's `Sites.Selected` app cannot be used here. {% hint style="info" %} The PnP Management Shell multi-tenant app was discontinued on 9 September 2024. Use your own registered Entra ID app with the appropriate admin permissions and pass its `-ClientId`. {% endhint %} ### Enable the site collection app catalog ```powershell Connect-PnPOnline ` -Url "https://-admin.sharepoint.com" ` -Interactive ` -ClientId "" Add-PnPSiteCollectionAppCatalog ` -Site "https://.sharepoint.com/sites/" ``` ### Grant the engineer's Entra app access to the site collection Run while still connected to the SharePoint Admin Center: ```powershell Grant-PnPEntraIDAppSitePermission ` -AppId "" ` -DisplayName "AnywhereNow-UCC-SitesSelected" ` -Site "https://.sharepoint.com/sites/" ` -Permissions FullControl ``` {% hint style="warning" %} `FullControl` is required — uploading to the site collection app catalog requires `Manage Web Site` permission, which is only included in the `FullControl` grant level. `Write` is not sufficient. This grant covers the root site collection and all subsites. No additional permission grants are needed when new UCC subsites are added later. {% endhint %} ### Verify the permission grant Confirm the grant was applied before handing over to the engineer: ```powershell Get-PnPEntraIDAppSitePermission ` -Site "https://.sharepoint.com/sites/" ``` The output lists all apps with access to the site. Confirm that the display name you used in `Grant-PnPEntraIDAppSitePermission` appears with permission level `FullControl`. {% hint style="info" %} Older deployment documentation may reference `Grant-PnPAzureADAppSitePermission` and `Get-PnPAzureADAppSitePermission`. Use `Grant-PnPEntraIDAppSitePermission` and `Get-PnPEntraIDAppSitePermission` instead. {% endhint %} ### Hand over to the engineer Provide the engineer with the following: | Item | Description | | ----------------------------- | ---------------------------------------------- | | `ClientId` | Application (client) ID of the Entra ID app | | `TenantId` | Directory (tenant) ID from Entra ID | | `CertificatePath` | Path to the `.pfx` certificate file | | `CertificatePassword` | The certificate password | | `SiteCollectionUrl` | The root site collection URL created in Part 1 | | `SiteCollectionAppCatalogUrl` | Same as `SiteCollectionUrl` | The administrator is not involved in any further steps. *** ## Part 3 — Delegated Engineer: first deployment Run these steps once when setting up a new UCC site collection. ### Step 1 — Deploy the SPFx package Uploads the UCC Dashboard SPFx package to the site collection app catalog and installs it on any already-provisioned subsites. ```powershell $certPassword = Read-Host -Prompt "Enter certificate password" -AsSecureString .\Deploy-UccDashboard.ps1 ` -SiteCollectionAppCatalogUrl "https://.sharepoint.com/sites/" ` -ClientId "" ` -CertificatePath "" ` -CertificatePassword $certPassword ``` *Estimated time: 30 seconds – 1 minute.* ### Step 2 — Initialize the site collection and provision UCC sites Configures the root site collection and processes any pending UCC site requests from the `A365_UCC_Creator` list. ```powershell .\UCC.Site.Creator.ps1 ` -paramSiteCollectionUrl "https://.sharepoint.com/sites/" ` -paramSiteOwner "@.onmicrosoft.com" ` -paramCertificateAppId "" ` -paramCertificateTenantId "" ` -paramCertificatePath "" ` -paramCertificatePassword $certPassword ` -UseSubSites ` -UseSiteCollectionAppCatalog ` -SiteCollectionPreCreated ``` {% hint style="warning" %} The `-SiteCollectionPreCreated` switch is required when using `Sites.Selected` permissions. Without it, the script attempts to create the site collection itself and fails because the app lacks the necessary permissions. {% endhint %} *Estimated time: 15 – 30 minutes for the first site.* *** ## Part 4 — Delegated Engineer: ongoing operations ### Adding a new UCC subsite When a new UCC request appears in the `A365_UCC_Creator` list with status `Requested`, re-run Step 2. The script picks up all pending requests automatically. *Estimated time: 15 – 30 minutes per new UCC subsite.* ### Updating the SPFx package after a new release Re-run Step 1 with `-Force`. The script re-uploads the package and updates the app on all provisioned subsites. ```powershell .\Deploy-UccDashboard.ps1 ` -SiteCollectionAppCatalogUrl "https://.sharepoint.com/sites/" ` -ClientId "" ` -CertificatePath "" ` -CertificatePassword $certPassword ` -Force ``` *** ## What's next? With the site collection app catalog enabled, permissions granted, and UCC sites provisioned, your Sites.Selected deployment is complete. Ongoing provisioning — adding new UCC subsites or updating the SPFx package after a new release — is handled entirely by the engineer using the scripts above. Return to [Create UCC Site](/set-up-dialogue-cloud-neo/prerequisites/configure-sharepoint-sites/create-ucc-site.md) for reference on the `-SiteCollectionPreCreated` and `-UseSubSites` parameters used throughout this guide. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://atlas.anywhere.now/set-up-dialogue-cloud-neo/prerequisites/configure-sharepoint-sites/sites-selected-permissions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.