Genesys Cloud - Developer Community!

Hello Sachin - 

To restrict access to only specific SharePoint sites, you will need to manage permissions at the Microsoft 365/Azure AD level rather than within Genesys Cloud.

1.Use Sites.Selected Permission in Azure AD App Registration:

• Replace the current Sites.Read.All permission with Sites.Selected
• Sites.Selected allows access only to SharePoint sites that have been explicitly granted to the application

2.Grant Site-Specific Permissions via Microsoft Graph API:

• Use PowerShell or Graph API to grant your registered application access only to specific SharePoint sites
• Identify the Site ID of your "Genesys Knowledge Fabric" site and assign read permissions only to that site

3.Implementation Location:

• Azure Portal > App registrations > Your Genesys integration app
• Coordination with your Microsoft 365 administrator will be required

Hi Dachin,

Restricting to site: all: selected will break the connector so the recommendation is site: all: read.

This reads the sites that the admin setting up the connection has access to and allows read access to those. 

More info on permissions needed can be found here: https://help.genesys.cloud/faqs/how-can-i-get-the-credentials-needed-for-the-sharepoint-knowledge-connect-integration/

Amanda

Hello Sachin - 

To restrict access to only specific SharePoint sites, you will need to manage permissions at the Microsoft 365/Azure AD level rather than within Genesys Cloud.

1.Use Sites.Selected Permission in Azure AD App Registration:

• Replace the current Sites.Read.All permission with Sites.Selected
• Sites.Selected allows access only to SharePoint sites that have been explicitly granted to the application

2.Grant Site-Specific Permissions via Microsoft Graph API:

• Use PowerShell or Graph API to grant your registered application access only to specific SharePoint sites
• Identify the Site ID of your "Genesys Knowledge Fabric" site and assign read permissions only to that site

3.Implementation Location:

• Azure Portal > App registrations > Your Genesys integration app
• Coordination with your Microsoft 365 administrator will be required

Hi @Amanda Halpin,

Thank you for your clarification. Based on those details, we are proposing the following approach:

1. SharePoint: We will create a Service Account with access restricted to a single site (we used this account earlier to send authorization request to MS)

2. Genesys: We will create the Service Account and grant this Service Account Admin privileges to configure the Knowledge Fabric integration.

3. Optimization: Once the setup is complete, we plan to deactivate the account in Genesys to ensure it does not consume a seat license.

Could you please confirm if you foresee any technical challenges or permission persistence issues with this approach?

Hi Dachin,

Restricting to site: all: selected will break the connector so the recommendation is site: all: read.

This reads the sites that the admin setting up the connection has access to and allows read access to those. 

More info on permissions needed can be found here: https://help.genesys.cloud/faqs/how-can-i-get-the-credentials-needed-for-the-sharepoint-knowledge-connect-integration/

Amanda

Hello Sachin - 

To restrict access to only specific SharePoint sites, you will need to manage permissions at the Microsoft 365/Azure AD level rather than within Genesys Cloud.

1.Use Sites.Selected Permission in Azure AD App Registration:

• Replace the current Sites.Read.All permission with Sites.Selected
• Sites.Selected allows access only to SharePoint sites that have been explicitly granted to the application

2.Grant Site-Specific Permissions via Microsoft Graph API:

• Use PowerShell or Graph API to grant your registered application access only to specific SharePoint sites
• Identify the Site ID of your "Genesys Knowledge Fabric" site and assign read permissions only to that site

3.Implementation Location:

• Azure Portal > App registrations > Your Genesys integration app
• Coordination with your Microsoft 365 administrator will be required

Hi Sachin,

This would need to be tested as you may come into issues when you want to re-sync the data from the SharePoint site. 

I believe you're in touch with our Professional Services team so I suggest testing out this plan with them.

Thanks,

Amanda

Hi @Amanda Halpin,

Thank you for your clarification. Based on those details, we are proposing the following approach:

1. SharePoint: We will create a Service Account with access restricted to a single site (we used this account earlier to send authorization request to MS)

2. Genesys: We will create the Service Account and grant this Service Account Admin privileges to configure the Knowledge Fabric integration.

3. Optimization: Once the setup is complete, we plan to deactivate the account in Genesys to ensure it does not consume a seat license.

Could you please confirm if you foresee any technical challenges or permission persistence issues with this approach?

Hi Dachin,

Restricting to site: all: selected will break the connector so the recommendation is site: all: read.

This reads the sites that the admin setting up the connection has access to and allows read access to those. 

More info on permissions needed can be found here: https://help.genesys.cloud/faqs/how-can-i-get-the-credentials-needed-for-the-sharepoint-knowledge-connect-integration/

Amanda

Hello Sachin - 

To restrict access to only specific SharePoint sites, you will need to manage permissions at the Microsoft 365/Azure AD level rather than within Genesys Cloud.

1.Use Sites.Selected Permission in Azure AD App Registration:

• Replace the current Sites.Read.All permission with Sites.Selected
• Sites.Selected allows access only to SharePoint sites that have been explicitly granted to the application

2.Grant Site-Specific Permissions via Microsoft Graph API:

• Use PowerShell or Graph API to grant your registered application access only to specific SharePoint sites
• Identify the Site ID of your "Genesys Knowledge Fabric" site and assign read permissions only to that site

3.Implementation Location:

• Azure Portal > App registrations > Your Genesys integration app
• Coordination with your Microsoft 365 administrator will be required

Hi @Amanda Halpin

We followed the suggested steps but were unsuccessful. Here is the current status:

• Configuration: All setup was completed in Genesys using the service account(incognito window).

• Testing: We verified the behavior in an incognito session.

• Result: The service account continues to view and sync all sites, seemingly bypassing the restricted Microsoft permissions.

Do you have any other inputs/feedback to limit visibility to Sites

Hi Sachin,

This would need to be tested as you may come into issues when you want to re-sync the data from the SharePoint site. 

I believe you're in touch with our Professional Services team so I suggest testing out this plan with them.

Thanks,

Amanda

Hi @Amanda Halpin,

Thank you for your clarification. Based on those details, we are proposing the following approach:

1. SharePoint: We will create a Service Account with access restricted to a single site (we used this account earlier to send authorization request to MS)

2. Genesys: We will create the Service Account and grant this Service Account Admin privileges to configure the Knowledge Fabric integration.

3. Optimization: Once the setup is complete, we plan to deactivate the account in Genesys to ensure it does not consume a seat license.

Could you please confirm if you foresee any technical challenges or permission persistence issues with this approach?

Hi Dachin,

Restricting to site: all: selected will break the connector so the recommendation is site: all: read.

This reads the sites that the admin setting up the connection has access to and allows read access to those. 

More info on permissions needed can be found here: https://help.genesys.cloud/faqs/how-can-i-get-the-credentials-needed-for-the-sharepoint-knowledge-connect-integration/

Amanda

Hello Sachin - 

To restrict access to only specific SharePoint sites, you will need to manage permissions at the Microsoft 365/Azure AD level rather than within Genesys Cloud.

1.Use Sites.Selected Permission in Azure AD App Registration:

• Replace the current Sites.Read.All permission with Sites.Selected
• Sites.Selected allows access only to SharePoint sites that have been explicitly granted to the application

2.Grant Site-Specific Permissions via Microsoft Graph API:

• Use PowerShell or Graph API to grant your registered application access only to specific SharePoint sites
• Identify the Site ID of your "Genesys Knowledge Fabric" site and assign read permissions only to that site

3.Implementation Location:

• Azure Portal > App registrations > Your Genesys integration app
• Coordination with your Microsoft 365 administrator will be required