# FAM sharepoint online least set of privilege

**URL:** <https://community.sailpoint.com/discuss/t/fam-sharepoint-online-least-set-of-privilege/37067>\
**Category:** Administration & Troubleshooting\
**Tags:** connector\
**Created:** [November 20, 2025, 4:22pm UTC](https://community.sailpoint.com/discuss/t/fam-sharepoint-online-least-set-of-privilege/37067 "2025-11-20T16:22:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Div\_sec](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@Div\_sec](https://community.sailpoint.com/discuss/u/Div_sec)\
**Post date:** [November 20, 2025, 4:22pm UTC](https://community.sailpoint.com/discuss/t/fam-sharepoint-online-least-set-of-privilege/37067/1 "2025-11-20T16:22:56Z")

</div>

Hello,

We understand that it needs&nbsp;Sites.FullControl.All permission as per documentation but we mainly need to crawl , set alerts and generate reports on the data read. And not do any changes. Is there any least set of privilege that can be used instead of&nbsp;Sites.FullControl.All ? We tried the read privilege but permission collector task failed.

---

<div class="post-metadata">

**Author:** ![ranjith\_koppu](https://sea3.discourse-cdn.com/sailpoint2/discuss/user_avatar/community.sailpoint.com/ranjith_koppu/32/17482_2.png) [@ranjith\_koppu](https://community.sailpoint.com/discuss/u/ranjith_koppu)\
**Post date:** [November 21, 2025, 3:14pm UTC](https://community.sailpoint.com/discuss/t/fam-sharepoint-online-least-set-of-privilege/37067/2 "2025-11-21T15:14:34Z")

</div>

Hello&nbsp; @Div_sec &nbsp;,

This has been asked my many customers earlier. This permission is required by Microsoft and is not mandated by SailPoint. To do crawls, FAM needs to be able to read through the SharePoint sites, folder data and folders meta-data which is currently allowed by the Sites.FullControl.All permission only. Due to this restriction, you are required to assign this permission for FAM to be able to complete the tasks successfully.

Thanks.

Ranjith

---

<div class="post-metadata">

**Author:** ![Div\_sec](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@Div\_sec](https://community.sailpoint.com/discuss/u/Div_sec)\
**Post date:** [November 26, 2025, 12:47pm UTC](https://community.sailpoint.com/discuss/t/fam-sharepoint-online-least-set-of-privilege/37067/3 "2025-11-26T12:47:01Z")

</div>

oh thank you for responding. To&nbsp;ensure that SailPoint FAM does not write, create, or delete any content in SharePoint or OneDrive because of Sites.FullControl.All permission being granted. Specifically, what configurations, best practices, and restrictions can we implement within FAM to prevent any unintended actions?