0

I am trying to show SharePoint list items from a different site collection in a SharePoint adaptive card extension using Graph API. This is working as expected for any user who has access to the SharePoint list.

Do we have any options to show the SharePoint list items in spfx who doesn't have access to the list.

When checked, I could see to use GraphAPI from SharePoint, there is a default app registered in Azure under the name "SharePoint Online Client Extensibility Web Application Principal". The App has delegated permission for Sites.ReadAll and Sites.ReadWriteAll as shown below:

enter image description here enter image description here

So along with this I tried to add Sites.ReadAll with application permission as shown below:

enter image description here

But this doesn't made any change and the list of items were not visible for any users without access to the list.

Please let me know if we have any option to show the SharePoint list items in an SPFx app without giving the end user read access to the list.

Improve this question

2 Answers 2

Reset to default
3

"Delegated Permissions" mans the app will assume the security context of the logged in user. Application Permissions are not used by SharePoint Framework.

Users should never be shown data they do not have access to. That is the whole point of security.

Improve this answer
1
  • Thank you, I understood. In our case we have a restricted list in a site where access is not given to all users which hold data about all the users. But we have to show some data which is specific to the logged in user in another site (intranet site). We thought of using some adaptive cards to show this. Do we have any option to get this list data in an spfx app with an elevated or app-only kind of permission similar to something we used to implement in server side code. Commented Jul 6, 2022 at 3:23
1

SharePoint Framework always runs with current user's context so you will not able to access anything where current user don't have access.

You need to create middle layer API which gets data from another site collection using Application.

Below is the link where you can find similar scenario where Item is being added using API with elevation.

https://github.com/pnp/sp-dev-fx-webparts/tree/main/samples/react-sp-elevatedprivileges

Hope it will help you.

Improve this answer

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.