Minimal SharePoint permissions

[DJFoxHound]

I've been contacted to work out an automatic process to convert GitHub md files to SharePoint pages.
It seems like doctor would fit perfectly to handle this request.

One thing that does raise eyebrows is the described need for Sites.FullControl.All permissions on SharePoint for the app registration.
It seems a bit too elevated, and I was wondering, what are the actual tasks it needs to be able to perform on SharePoint?

Wouldn't a Sites.Manage.All, or even a Sites.ReadWrite.All, be sufficient to create and update the the SharePoint pages?

[bentolor]

As I'm looking to employ Doctor in an enterprise setting as well, I'd also be interested in an answer on that @DJFoxHound.

How do you do this in your setting, @estruyf? Separate Sharepoint Sites as targets?

[estruyf]

@DJFoxHound feel free to give it a try, it is too long for me to know the actual reason I went for Sites.FullControl.All. Let me know the outcome of your test.

@bentolor originally, we had a documentation account that we used to run doctor. Such accounts are easier to manage.

[sebhe]

Did anyone try Sites.Selected permission instead? With this permission it seems to be possible to scope permissons just to a specific site collection
https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins-modernize/understanding-rsc-for-msgraph-and-sharepoint-online