Summary

Microsoft Excel credentials can now be recognized by the SharePoint site selector, but the existing Excel OAuth consent does not authorize Microsoft Graph site search.

Graph site search requires Sites.Read.All. Sim’s Excel connection currently requests file permissions only, so an ordinary existing Excel credential should be expected to receive a 403. The endpoint also does not support delegated personal Microsoft accounts.

This is a pre-existing consent-model limitation, not a selector transport or credential-binding bug.

Decision needed

Choose and implement one supported model:

1. Add Sites.Read.All to the standard Excel consent and require existing users to reconnect/reconsent.
2. Add conditional or incremental consent when SharePoint site discovery is requested.
3. Require a separate SharePoint credential for site discovery and narrow the Excel selector compatibility accordingly.

The decision should account for least privilege, reconnect UX, existing credentials, and personal-account behavior.

Acceptance criteria

• The supported Excel/SharePoint credential model is documented.
• OAuth scopes, reconnect/reconsent behavior, and selector credential binding agree.
• Unsupported credentials receive a clear product-level error.
• Focused permission/binding tests and live work-or-school tenant validation are added.
• Existing Excel file operations continue to work.

Reference

Microsoft Graph site search requires Sites.Read.All and does not support delegated personal Microsoft accounts:

https://learn.microsoft.com/en-us/graph/api/site-search?tabs=http&view=graph-rest-1.0