What you will need

• A SharePoint Administrator or Global Administrator role in your Microsoft 365 tenant.
• The full URL of the SharePoint site the user is trying to access (e.g. https://contoso.sharepoint.com/sites/Engineering). Ask the user to confirm the exact URL.
• About 2 to 5 minutes.

You do not need a Highbay account to complete this step.

App identification

These values are required by the scripts below. They identify the Highbay app registration in Microsoft's systems.

Two ways to grant access

Choose the path that works best for you.

Path 1: PowerShell (recommended)

This script uses the Microsoft.Graph PowerShell module. If you do not have it, run Install-Module Microsoft.Graph -Scope CurrentUser first. You only need to do that once.

Open a PowerShell session and run:

# Grant Highbay Portal access to a SharePoint site.
# Run as a SharePoint Administrator or Global Administrator.
# Requires the Microsoft.Graph module.

Connect-MgGraph -Scopes "Sites.FullControl.All"

$AppId          = "30e56f41-e7f2-4a37-bdb4-cbba410fa3fe"
$AppDisplayName = "Highbay Portal"
$SiteUrl        = Read-Host "Enter the full SharePoint site URL"
$Role           = Read-Host "Permission level: read or write"

# Resolve site ID from URL
$Uri    = [System.Uri]$SiteUrl
$SiteId = "$($Uri.Host):$($Uri.AbsolutePath)"
$Site   = Get-MgSite -SiteId $SiteId

# Build the permission body
$Body = @{
    roles               = @($Role)
    grantedToIdentities = @(
        @{
            application = @{
                id          = $AppId
                displayName = $AppDisplayName
            }
        }
    )
}

New-MgSitePermission -SiteId $Site.Id -BodyParameter $Body

Write-Host "Done. Granted $Role on $($Site.DisplayName) to $AppDisplayName."

When prompted, sign in with your administrator account. Enter the full site URL (e.g. https://contoso.sharepoint.com/sites/Engineering) and choose read or write as the permission level.

The script takes under a minute. Once it completes, users in your tenant can see the site in the Highbay file picker.

Path 2: Graph API (for admins who prefer REST)

If you have an existing automation pipeline or prefer calling the API directly, use these two calls with an admin bearer token that has Sites.FullControl.All.

Step 1: Resolve the site ID from the URL.

GET https://graph.microsoft.com/v1.0/sites/contoso.sharepoint.com:/sites/Engineering
Authorization: Bearer {admin-access-token}

The response includes an "id" field that looks like contoso.sharepoint.com,{guid},{guid}. Copy the full value.

Step 2: Post the permission grant.

POST https://graph.microsoft.com/v1.0/sites/{site-id}/permissions
Authorization: Bearer {admin-access-token}
Content-Type: application/json

{
  "roles": ["read"],
  "grantedToIdentities": [
    {
      "application": {
        "id": "30e56f41-e7f2-4a37-bdb4-cbba410fa3fe",
        "displayName": "Highbay Portal"
      }
    }
  ]
}

A 201 response means the grant was created successfully.

Permission levels

When prompted to enter a permission level, use read for most Highbay workflows. Write is only needed if users need to save files back to SharePoint from Highbay.

Verifying the grant worked

Two ways to confirm:

• From PowerShell: Run the following to list all app permissions on the site.

  $Site = Get-MgSite -SiteId "contoso.sharepoint.com:/sites/Engineering"
  Get-MgSitePermission -SiteId $Site.Id | Format-List

  Look for an entry with GrantedToIdentities.Application.Id matching 30e56f41-e7f2-4a37-bdb4-cbba410fa3fe.
• From the Highbay app: Ask the user to sign out and sign back in, then open the file picker and click the SharePoint Sites tab. The site should appear in the list.

Token caches can delay propagation by up to 30 minutes. If the site does not appear immediately, ask the user to sign out and sign back in to get a fresh token.

Revoking access later

You can revoke the app's access to a site at any time. After revocation, Highbay users will no longer see the site in their file picker. Files previously attached remain as links in Highbay, but the app can no longer read new files from that site.

Via PowerShell:

$Site = Get-MgSite -SiteId "contoso.sharepoint.com:/sites/Engineering"

# Find our app's permission entry
$Permissions = Get-MgSitePermission -SiteId $Site.Id
$OurPerm = $Permissions | Where-Object {
    $_.GrantedToIdentities.Application.Id -eq "30e56f41-e7f2-4a37-bdb4-cbba410fa3fe"
}

# Remove it
$OurPerm | ForEach-Object {
    Remove-MgSitePermission -SiteId $Site.Id -PermissionId $_.Id
    Write-Host "Revoked permission $($_.Id)"
}

Via the SharePoint admin center: Navigate to the site in the SharePoint admin center, open Site settings, then Site app permissions. Find Highbay Portal and remove it.

Troubleshooting

First-time admin consent

The first person from your organization to connect Highbay with SharePoint support enabled will see a Microsoft screen that says "An administrator must consent to this permission before you can use it." This is expected behavior for the Sites.Selected scope.

This is a one-time per-tenant step, separate from the per-site grants above. It only needs to happen once. After an administrator consents, all other users in your organization can connect without seeing this screen.

How to complete it:

1. Have an administrator in your organization sign in to Highbay and connect their Microsoft 365 account from the integrations page. During the Microsoft OAuth flow, the admin will see a consent screen asking them to approve on behalf of the organization.
2. The admin clicks "Accept." From that point on, any user in your tenant can connect Highbay without the admin consent prompt.

The tenant-level consent only approves the Sites.Selected scope on behalf of your organization. It does not grant access to any specific SharePoint site. Site access is still controlled by the per-site grant process described in the sections above.