How to Add Permissions Required For MSGraph

Minimum Permissions

## Least-Privilege Permission Set

| Task | Permission Required | Type | Scope / Notes |
|------|---------------------|------|----------------|
| Upload files to a specific site | `Sites.Selected` | Application | Grant `role: write` to the app on that one site via `POST /sites/{site-id}/permissions` |
| Delete files on that specific site | `Sites.Selected` | Application | Covered by the same `write` role grant — no additional permission needed |
| Create / manage email category definitions | `MailboxSettings.ReadWrite` | Application | Applies tenant-wide to mailbox settings by default |
| Assign a category to a specific email | `Mail.ReadWrite` | Application | Required to modify the `categories` property on a message |
| Read email (Subject, Body, To, From, CC, Attachments, mailbox owner) | `Mail.ReadWrite` | Application | `Mail.Read` alone would suffice in isolation, but is redundant once `Mail.ReadWrite` is already required above |

### Final Consolidated Permissions

| Permission | Type | Covers |
|------------|------|--------|
| `Sites.Selected` | Application | File upload + delete, scoped to a single SharePoint site |
| `MailboxSettings.ReadWrite` | Application | Creating and editing email category definitions |
| `Mail.ReadWrite` | Application | Full email reading + assigning categories to messages |

> **Note:** `MailboxSettings.ReadWrite` and `Mail.ReadWrite` are tenant-wide across all mailboxes by default. To restrict mail access to specific mailboxes only, layer on an **Exchange Online Application Access Policy** in addition to these Graph permissions.