M365 on wporter.org

Granting a principal API access to a single SharePoint site with Sites.Selected permissions - Graph API and PowerShell

Wed, 23 Sep 2026 21:00:00 +0000

Introduction

When granting a principal access to anything, it’s best practice to scope that access down as much as possible. As of 2026, the only way to avoid granting full access to every SharePoint site to your application when you need to access some SharePoint data is to use the Sites.Selected Graph permission. Unfortunately, to grant Sites.Selected access to SharePoint Online, you’ll need to make API requests; this permission is not available through the Entra app registration admin interface. You’ll also need to create the read/write permission on the SharePoint site you want the application to have access to (Sites.Selected permissions are an implicit deny; the ’exclusions’ are applied to the SharePoint site and also cannot be modified through the web interface).

Configuring the cloud Kerberos trust - Kerberos SSO to domain resources with WHfB for Entra-joined clients

Sat, 07 Mar 2026 17:30:00 +0000

The scenario: I have a hybrid AD environment (identity and password hash synchronization) with Entra-joined endpoints. I’d like to authenticate to both cloud resources and on-premise domain-joined resources (via Kerberos) with my Windows Hello keypair.

Introduction

Entra-joined devices authenticating to domain resources

Right out of the box, an Entra-joined workstation with a user who’s synchronized from the on-premise domain and has signed in with a password will be able to authenticate to domain resources.

Updating multiple M365 mailboxes' autoreply settings

Thu, 20 Mar 2025 12:13:59 +0000

Quick one for a personal reminder.

You can also schedule an autoreply by setting State to Scheduled, and providing a StartTime and EndTime.

# set autoreply for multiple users

$Message = @"
This mailbox is no longer monitored.<br>
<br>
If you require assistance, please contact so-and-so in the Doing Stuff office.<br>
<br>
Thank you,<br>
IT
"@

@('user1@domain.net','user2@domain.net') | % { 
    Set-MailboxAutoReplyConfiguration `
        -Identity $_ `
        -AutoReplyState Enabled `
        -ExternalMessage $Message `
        -InternalMessage $Message `
        -ExternalAudience All
}

POST an Intune app registration to the Microsoft Graph API

Thu, 03 Oct 2024 12:34:56 +0000

Problem: “The selected app does not have a latest package version” error preventing app registration in Intune/Endpoint Admin Center

Attempting to register Adobe Acrobat Reader DC (XPDP273C0XHQH2) as an Intune app of type Windows Store (New) results in a “The selected app does not have a latest package version” error. Intune admin center says that “This app is not supported in preview.”

This seems to be a version error that seems to be caused by PackageVersion: Unknown, according to Sander Rozemuller, a M365 blogger. Speaking of them, thanks to Sander Rozemuller’s blog post on the topic for showing me that I can get around this. Without that post I would probably have stayed lost.