What can an AI agent do with
Edit or delete items on SharePoint sites you can reach (Sites.ReadWrite.All, delegated)?
It can read, edit, and delete documents and list items on SharePoint sites, acting as you. It is limited to what you are allowed to see and change.
How to spot it
On a Microsoft 365 (Microsoft Graph) connection or settings screen, this is Sites.ReadWrite.All.
With it, an agent can
- Read documents and lists on SharePoint sites you can open
- Edit documents and list items
- Delete documents and list items
It cannot, on its own
- Go beyond what you are allowed to see and edit
What a bad day looks like
A confused agent could change entries in a shared list your team relies on, like an inventory or job tracker, or delete documents from a team site.
Set it up safer
- Ask for Sites.Selected, so only the sites your admin picks can be reached.
- If it only reads, ask for Sites.Read.All.
Ask the company selling the agent
- Which SharePoint sites does the agent need, and why all of them?
- Will it ever delete documents or list items?
- Can it work with Sites.Selected instead?
Source
Checked against Microsoft 365 (Microsoft Graph) documentation on 2026-09-28. All Microsoft 365 (Microsoft Graph) permissions →
Thinking about a specific agent?
Tell us what it connects to, what it is allowed to do and who approves its work. You get a plain-language label of what it can touch and what to ask the seller. It takes a couple of minutes, and your answers stay in your browser unless you choose to post a test job.
Or have a person go through the AI apps on up to 3 of your business services with you and get a written report, for $249.
This page explains what a permission allows. It does not describe, test or rate any product. Permission details are summarized in our own words from the provider's documentation, linked on the page; providers change their documentation, so check the source before you rely on a detail.