Inventory of sites and permissions
Lists the sites with getAllSites, each one's libraries, and walks each drive with delta and Prefer: hierarchicalsharing, reading permissions only at the inheritance roots.
Octo for SharePoint, OneDrive, Teams and Power Automate
Every site has an owner. The one who decides who gets in is you.
In Microsoft 365, sites, libraries, files and permissions go through Microsoft Graph. Octo inventories the tenant read-only, points out anonymous links and broken inheritance, proposes the minimum permission for each app, measures the network folder before migrating and treats Power Automate flows as reviewable code. Consent, access, personal data and publishing stay with the administrator and with each site's owner.
SharePoint throttling, per app1,250RU per minute in the tier of up to 1,000 licenses
SharePoint file limit250 GBand a decoded path of up to 400 characters
OneNote without app-only sinceMar 31, 2025delegated permission only
Sources24listed at the end of the page
01
What Octo does with Microsoft 365.
Six possible deliverables, drawn from the research. All of them start by reading, all of them request the smallest permission that does the job, and all of them go to review by whoever administers the tenant and whoever owns the content.
Minimum permission per app
Replaces the Sites.ReadWrite.All requested "for testing" with Sites.Selected with a read or write role on the site that matters, and records how to revoke it.
Migration pre-scan
Measures the network folder before the window: paths over 400 characters with the target prefix, files over 250 GB, suspicious names, duplicates by SHA-256, folders with personal data.
Deliverable: a CSV manifest for the data owner to approveUpload by upload session
Only what was approved goes, with createUploadSession, conflictBehavior set to fail, 10 MiB fragments and respect for Retry-After.
Flows as code
Exports the solution with pac solution export, unpacks it and reviews each flow's JSON by diff; imports with a settings file per environment.
What was left behind
Finds scripts that still depend on SharePoint Add-ins and ACS, retired on Apr 2, 2026, and OneNote integrations that relied on app permissions.
Deliverable: list of what stopped or will stop, with the new path
02
Eight arms, a checked tenant.
The same Octo cycle, applied to Microsoft 365. Each arm has a narrow role; the ones who consent, grant access and answer for the data are people.
-
Discovery
Surveys what already exists
Sites, libraries, teams, flows, registered apps and what still depends on Add-ins and ACS.
-
Data
Maps the content
Libraries, columns, versions, volume and what becomes metadata in the migration.
-
Security
Looks after access
Minimum permission per app, anonymous links, external guests and folders with personal data (LGPD, Brazil's data protection law) flagged.
-
Architecture
Chooses the path
Graph directly, PnP PowerShell, Migration Manager or a Power Platform solution, depending on the task and the volume.
-
Development
Writes the script
Inventory, pre-scan and upload with throttling respected and the source of each syntax noted.
-
Review
Checks by content
Permission listed on the site, size at the target, a diff of the flow's JSON before importing.
-
Release
Prepares, doesn't apply on its own
Package and script ready; applying to the tenant is done with a person's approval.
-
Documentation
Records what applies in your tenant
Inventory, permissions granted, who approved, the migration manifest and how to roll back.
Octo does not consent to permissions, does not keep app certificates or secrets, does not open or close access on its own and does not answer for the data stored in the tenant.
03
Every task, its own path.
The criteria Octo uses to choose, with the call and the documented least-privilege permission.
| Task | Path | Notes |
|---|---|---|
| List all sites | GET /sites/getAllSites | App only, Sites.Read.All |
| Scan files and changes | GET /drives/{id}/root/delta | Files.Read.All; save the deltaLink |
| Find only permission roots | Prefer: hierarchicalsharing | A permission operation costs 5 RU |
| Read an item's permissions | GET .../items/{id}/permissions | Direct in grantedToV2, by link in grantedToIdentitiesV2; the permission root comes from delta |
| Grant access to a single site | Sites.Selected + POST /sites/{id}/permissions | Writing requires Sites.FullControl.All; in a delegated session, a SharePoint admin who is a site member |
| Revoke that access | DELETE /sites/{id}/permissions/{id} | Or revoke the consent |
| Upload a large file | createUploadSession + PUT | Multiples of 320 KiB, under 60 MiB |
| Combine calls | POST /$batch | Up to 20; throttling counts each one |
| Migrate a network share | Migration Manager | Agents, CSV, files up to 250 GB |
| Export and promote flows | pac solution export / import | Imports the managed zip, with --settings-file per environment |
| Message in a Teams channel | POST /teams/{id}/channels/{id}/messages | Delegated; app only for migration |
| OneNote notebooks | /me/onenote/... | Delegated only since Mar 31, 2025 |
04
From clicks in the admin center to a tenant with a record.
Three steps. Each one only makes sense after the previous one has shown results on your team.
A proposal, not a promise
Inventory and alerts
Octo shows what is in the tenant and where access is too open, without writing anything.
- Spreadsheet of sites and libraries
- Permissions at the inheritance roots
- List of links and guests for the owners
Minimum permission and measured migration
Apps start seeing only the site they need; migrations start with a pre-scan and a manifest.
Sites.Selectedinstead of.All- Manifest approved line by line
- Upload with a check
Flows and permissions with history
Flows under version control, promotion by solution and a record of each access granted.
- Diff before importing
- Who approved each access
- Rollback ready
05
Confirmed by a source.
Every point below has a source published by Microsoft (Learn and Support), by the package's official repository (PyPI, NuGet, PowerShell Gallery) or in Brazilian federal law. The examples are scripts to follow, not runs. The sources are in the next section.
4
points with a published source, each with its reference shown alongside.
- ConfirmedSite-by-site access
Sites.Selectedstarts with no access; the permission is written on the site withPOST /sites/{id}/permissionsand the rolesread,write,ownerorfullcontrol. On a list, item or file, it breaks inheritance. In a delegated session, whoever writes must be a SharePoint Administrator or higher and a member of the target site; the method only creates app permissions.Source: Microsoft Learn, selected permissions and creating a site permission- ConfirmedThrottling in resource units
- 1,250 RU per minute and 1,200,000 per day per app, in the tier of up to 1,000 licenses; a permission operation costs 5 RU; no RateLimit headers.Source: Microsoft Learn, SharePoint Online throttling
- ConfirmedMigration limits
- Files up to 250 GB, decoded paths up to 400 characters, 5,000 unique permissions recommended per list, sync recommended up to 300,000 files.Source: SharePoint Online service description
- ConfirmedOneNote delegated only
- The OneNote API stopped accepting app-only authentication on Mar 31, 2025.Source: Microsoft Learn, integrating with OneNote
06
What Octo does, and what stays with you.
Octo prepares everything, but it does not sign. The document of record stays with whoever is accountable for it.
Octo prepares
Surveys, organizes and produces the files: documents, spreadsheets, presentations, schedules, inventories and check reports, on file and through the APIs, without sending or publishing anything.
Deliverable: material ready to checkYour team checks
Whoever is accountable for the document, the spreadsheet or the schedule checks what Octo delivered before approving. If something doesn't add up, it goes back to Octo with the correction.
Step: checked by the person accountableWho signs and approves
Octo does not sign, approve or send. The document owner reviews and signs; the project manager approves the baseline; the Microsoft 365 administrator grants consent for permissions; the data protection officer approves anything that goes out with personal data.
Approval: document owner and 365 administrator
07
Sources.
Official documentation for Microsoft Graph, SharePoint Online, Entra ID and Power Platform, and the PnP PowerShell documentation, consulted on Oct 31, 2026.
- Graph, selected permissionsSites.Selected and related
- Entra ID, admin consentWho can consent
- Graph, driveItem deltahierarchicalsharing
- Scanning at scaleDiscover, scan, notify, process
- SharePoint, throttlingResource units
- SharePoint Online, limits250 GB, 400 characters
- Graph, createUploadSession320 KiB fragments
- Graph, OneNoteEnd of app-only
- Power Automate, limits30 days, 14 and 90 days
- pac solutionExport, unpack, import
- End of SharePoint Add-insApr 2, 2026
- PnP PowerShell, site permissionCommunity
- Graph, create site permissionSharePoint admin and site member
- Graph, get sitehost:/path address
- Graph, permission resourcegrantedToV2 and grantedToIdentitiesV2
- Graph, sharingLinkLink scope
- Graph, hashesquickXorHash
- Graph, metered APIsProtected APIs
- Get-MgSitePermissionCheck
- Remove-MgSitePermissionRollback
- MicrosoftTeams, New-TeamCreate a team
- MicrosoftTeams, Set-TeamArchivedStateArchive a team
- OneDrive and SharePoint, restrictionsInvalid names and characters
- SharePoint Migration ToolSPMT active and free
Your Microsoft 365, inventoried and with minimum access.
The assessment starts with an inventory of sites and permissions, read-only. You get the list of what is too open, what will stop working and the questions only your team can answer, and you decide with that in hand.