Tag Your Content
Connect SharePoint
Give Tag Your Content read access to one SharePoint site. It can't change or delete anything.
For a Microsoft 365 admin of your company. Microsoft asks for full control once: we use it only to grant read access to this one site, then drop the token. Microsoft keeps the approval on record; you can remove it in Entra afterwards.