Minimum permissions required to set Site Collection Admin of an user.

[yesh-rajawat-robomq]

My Azure AD Application currently has site.fullcontrol.all as application permission given which does a beautiful work of adding Site Collection Admin to a user. But some of the companies actually refrain from giving full control over their sites as they want to follow least privilege principle which states that you must give only the minimal required permission to the user. I Just wanted to know is there any permission that can be granted to Azure AD Application to permission the same task.

[jansenbe]

@yesh-rajawat-robomq : as you need full control at site collection level to set the site collection admin there's no other permission when using application permissions. What you however can possibly consider is using the sites.selected permission, using this an "customer admin app having sites.fullcontrol.all" can grant your app full control for one or more site collections. So your app will only have access to the granted site collections.

[yesh-rajawat-robomq]

@jansenbe Thank you for the response. Is there any way to grant permission to the application to access all the personal sites so that I can work with personal sites only if I give sites.selected. What I want is to the grant access of former employee's onedrive to their manager, and this seems to be the only working solution I have.

[jansenbe]

There's no automatic way