Granting SharePoint site access

Excel workbooks live in SharePoint, and ReportMesh cannot read a SharePoint site until it has been given access to that specific site. This page covers giving it that access, one site at a time.

Power BI reports need none of this. It applies only to Excel workbooks.

Who this is for: A SharePoint administrator or Global administrator, who runs the grant, and a ReportMesh administrator, who connects the site and produces the commands for them. If you hold both roles you are both people.

Prerequisite: The Sites.Selected permission from Setting up Entra ID, consented by a directory administrator.

Why it works this way

ReportMesh holds no blanket permission over your tenant. Sites.Selected grants access to nothing on its own — it only makes ReportMesh eligible to be granted individual sites. Each site is then opened up deliberately, and nothing outside those sites is reachable.

ReportMesh cannot do this for you, and there is no consent prompt that shortcuts it

Creating a site permission requires an administrator's own signed-in token with full control of the site. Microsoft offers no application permission that can do it, so the grant is run by hand, once per site, by a person.

If you are waiting for a popup to appear in ReportMesh, it is not coming. This is the step.

Who does what

Step	Who	Where
1. Connect the site	ReportMesh administrator	ReportMesh
2. Grant access to it	SharePoint or Global administrator	PowerShell, not ReportMesh
3. Register workbooks from it	Publisher	ReportMesh

Connecting a site grants nothing. It records the site and produces the commands for step 2. Publishers cannot register any Excel workbook from a site until step 2 has been done.

Step 1 — Connect the site in ReportMesh

1. Go to Settings → Site connections.
2. Choose to connect a site.
3. Enter the site URL — the site itself, not a file or folder inside it. For example https://yourtenant.sharepoint.com/sites/Finance.
4. Confirm.

The site appears in the list with its proper name and Access showing Not granted. That is expected at this point, not a failure.

If the URL will not resolve, check it is complete and correctly spelled, and that it names a site rather than a document library or a file within one.

Full instructions for this screen are in Connecting SharePoint sites.

Step 2 — Run the grant

Open How to grant access on the site's row. ReportMesh generates the commands already filled in with the site and its own application identity, so there is nothing to edit before running them. Each block copies with one click.

Whoever runs them needs SharePoint or Global Administrator and to be a Site Collection Administrator on the site itself. The admin role alone is not enough.

The commands use Microsoft Graph PowerShell. Install the module once, on the administrator's machine:

Install-Module Microsoft.Graph -Scope CurrentUser

Connect, signing in with the administrator's own account:

Connect-MgGraph -Scopes "Sites.FullControl.All"

The first time, this asks the administrator to consent to the Microsoft Graph PowerShell tool using Sites.FullControl.All on their behalf. That is their own session's permission, not ReportMesh's.

Then grant ReportMesh read access to the site:

New-MgSitePermission -SiteId "<site-id>" -BodyParameter @{
    roles = @("read")
    grantedToIdentities = @(
        @{
            application = @{
                id          = "<client-id>"
                displayName = "ReportMesh"
            }
        }
    )
}

ReportMesh fills in the site id for you — the site collection id, a GUID, which is short enough to check against the site you mean.

Subsites

The generated site id names a site collection. If the connected URL is a subsite, the command addresses its parent site collection instead. Check the id before running it against a subsite.

What you are asking an administrator to do

The grant is read-only and applies to that one site. It gives ReportMesh access to no other site, and it changes nothing about who in your organisation can see the site.

Step 3 — Confirm it took

Return to Settings → Site connections and check the Access column.

The status is read live every time you look at it. There is no cached value to go stale and nothing to refresh, so as soon as the grant is in place the column reads Granted.

Publishers can register workbooks from the site from that point on.

Revoking access

The mirror image, using How to revoke access on the same row. After installing the module and connecting as above, list the site's permissions:

Get-MgSitePermission -SiteId "<site-id>" | Select-Object Id, Roles, GrantedToIdentities

Find the entry whose application id is ReportMesh's client id, and remove it by its id:

Remove-MgSitePermission -SiteId "<site-id>" -PermissionId "<permission-id>"

Revoking access to a site does not remove the workbooks already registered from it. They remain catalogued and stop opening.

Checklist

• Sites.Selected shows Granted on the registration, consented by a directory administrator.
• The site is connected in Settings → Site connections.
• A SharePoint or Global administrator, who is a Site Collection Administrator on the site, has run the grant for that site.
• The Access column reads Granted.
• Repeated for every site holding workbooks to be registered.

Common problems

What you see	What it usually means
Access still reads Not granted	The grant has not been run yet. Connecting a site grants nothing by itself.
The site URL will not resolve	It names a library or a file rather than a site, or it is misspelled.
The grant command fails with a permissions error	Whoever ran it does not hold SharePoint or Global Administrator, is not a Site Collection Administrator on the site, or did not consent to Sites.FullControl.All when connecting.
One site works, another does not	The grant is per site. It has to be run again for each one.
A Publisher cannot register a workbook from a granted site	Check the Access column for that specific site, rather than assuming the grant covered more than one.
Workbooks stopped opening across every site at once	The client secret expired. Rotate it.

Next

The identity prerequisites are complete. Once the portal is running, Connecting SharePoint sites covers the day-to-day screen.