Fabric Notebook Help - SharePoint

[Rohitb]

Hi,

In most of the code that I am scanning across to upload file into sharepoint via service principal, sites.readwriteAll application permission is being provided to the app.

But that is the higesth privilge that an app would get across all sharepoints and we need to restrict it to a single sharepoint in which the app has been given access to.

So can someone share me the fabric notebook code to upload a file into sharepoint via service principal authentication with least minimum privilege

[wardy912]

import requests
from msal import ConfidentialClientApplication

client_id = 'YOUR-CLIENT-ID'
client_secret = 'YOUR-CLIENT-SECRET'
tenant_id = 'YOUR-TENANT-ID'
authority = f'https://login.microsoftonline.com/{tenant_id}'
scope = ['https://graph.microsoft.com/.default']

app = ConfidentialClientApplication(client_id, authority=authority, client_credential=client_secret)
token = app.acquire_token_for_client(scopes=scope)

headers = {
    'Authorization': f"Bearer {token['access_token']}",
    'Content-Type': 'text/plain'
}

file_content = 'Hello SharePoint!'
upload_url = 'https://graph.microsoft.com/v1.0/sites/{site-id}/drives/{drive-id}/root:/Folder/File.txt:/content'

response = requests.put(upload_url, headers=headers, data=file_content)
print(response.status_code, response.json())

[Rohitb]

@wardy912  : Thankyou for your response, Can you please let me know what API permission is needed for Service Principal for above code ?