Hello,
We understand that it needs Sites.FullControl.All permission as per documentation but we mainly need to crawl , set alerts and generate reports on the data read. And not do any changes. Is there any least set of privilege that can be used instead of Sites.FullControl.All ? We tried the read privilege but permission collector task failed.
Hello @Div_sec ,
This has been asked my many customers earlier. This permission is required by Microsoft and is not mandated by SailPoint. To do crawls, FAM needs to be able to read through the SharePoint sites, folder data and folders meta-data which is currently allowed by the Sites.FullControl.All permission only. Due to this restriction, you are required to assign this permission for FAM to be able to complete the tasks successfully.
Thanks.
Ranjith
oh thank you for responding. To ensure that SailPoint FAM does not write, create, or delete any content in SharePoint or OneDrive because of Sites.FullControl.All permission being granted. Specifically, what configurations, best practices, and restrictions can we implement within FAM to prevent any unintended actions?