Receives site access
Punchitect Enterprise
The separate Enterprise Entra application. This is the only Punchitect identity used in the site grant.
For Microsoft 365 Administrators
Connect Punchitect Enterprise to one SharePoint site
This browser-guided setup uses Microsoft's Graph Explorer. It does not install PowerShell modules or create an administrative helper app. Punchitect Enterprise remains separate from the standard Punchitect application.
Loading the Punchitect Enterprise identity…
Unaffected
Standard Punchitect
The standard Microsoft/OneDrive application is not used and receives no access from this workflow.
Temporary admin tool
Microsoft Graph Explorer
Microsoft's browser tool sends the site-assignment requests while your administrator is signed in.
01
Consent to Punchitect Enterprise
This one-time action creates Punchitect Enterprise under Entra ID → Enterprise applications in your tenant. Confirm that Microsoft's consent screen names Punchitect Enterprise before accepting.
User.Read
Reads the signed-in user's basic profile.
Sites.Selected
Allows delegated access only to SharePoint sites that IT assigns explicitly. Consent alone grants access to no site.
02
Open Microsoft Graph Explorer
Sign in to Graph Explorer with a SharePoint Administrator account. In Graph Explorer's permissions panel, consent temporarily to delegated Sites.FullControl.All.
Identity check: this temporary administrative permission belongs to Microsoft Graph Explorer. Punchitect Enterprise continues to request only
Sites.Selected, and standard Punchitect remains unaffected.
03
Find the dedicated SharePoint site
Enter the dedicated site's hostname and path. Copy the generated URL into Graph Explorer, select GET, and run it. Copy the full id from the response—not a SharePoint GUID from the admin center.
GET request URL
04
Assign the site to Punchitect Enterprise
In Graph Explorer, select POST, paste the request URL, and paste the JSON into the request body. The Enterprise Application/client ID is inserted automatically.
Before running: confirm the body names Punchitect Enterprise, uses the Enterprise client ID shown at the top of this page, and grants only
write to this dedicated site.
POST request URL
JSON request body
A successful request returns 201 Created. Save the returned permission id for verification and rollback.
05
Verify the Enterprise assignment
Select GET in Graph Explorer and run this request. Inspect the response before continuing.
GET request URL
- The application ID equals .
- The application display name is Punchitect Enterprise.
- The assigned role is
write.
Stop if these do not match. Do not continue if the response names standard Punchitect, Graph Explorer, or any other application.
06
Get the drive and root item IDs
List the site's document libraries. Choose the dedicated library—usually Documents—and copy its Graph drive id.
GET drives request URL
Then retrieve that library's root item and copy its id.
GET root item request URL
Enter these three values in Punchitect Enterprise: the composite Graph site ID, the selected Graph drive ID, and the root item ID.
07
Finish and remove Graph Explorer's temporary consent
Sign in to Punchitect using Sign in with SharePoint Enterprise and enter the three Graph identifiers. Test creating and opening a project in the dedicated site.
When testing succeeds, open Entra ID → Enterprise applications → Graph Explorer → Permissions → Admin consent, and revoke Graph Explorer's temporary Sites.FullControl.All permission.
Safe cleanup: removing Graph Explorer's temporary permission does not remove the separate Punchitect Enterprise site assignment.
Revoke Punchitect Enterprise site access
For immediate containment, disable Punchitect Enterprise or revoke its tenant consent in Entra. To remove only the selected-site assignment, an approved Microsoft Graph administrative client can send the following request using the saved permission ID.
DELETE request URL
Microsoft currently documents deletion of a site permission for application-authenticated administrative clients. If delegated deletion is blocked in Graph Explorer, use your organization's approved Graph administration tooling.
Microsoft delete-permission reference