Auto-grant Sites.Selected access to the SharePoint site created when provisioning a Microsoft 365 Group #3176

Is your feature request related to a problem? Please describe the problem.

When a site collection is created directly via POST /sites with the Sites.Create.All permission, the calling application is automatically granted Sites.Selected + FullControl on that new site collection — no extra step required (confirmed here: https://devblogs.microsoft.com/microsoft365dev/sharepoint-site-creation-in-microsoft-graph/).

This auto-grant does not extend to the SharePoint site provisioned automatically when a Microsoft 365 Group is created via POST /groups. An app that only holds Sites.Selected (not tenant-wide Sites.ReadWrite.All) can create the group, but has no access to the group's backing site afterwards — even though it triggered that site's creation. The only workaround is a manual follow-up call to POST /sites/{site-id}/permissions, adding an extra step, an extra failure point, and a possible race condition (the backing site is not always immediately addressable right after group creation).

Describe the solution you'd like.

Request: extend the existing Sites.Create.All → Sites.Selected auto-grant behavior to also cover sites provisioned indirectly as a side effect of Microsoft 365 Group creation, so an app with Sites.Selected that creates a group is automatically granted write access to that group's site too — consistent with how direct site creation already works.
This would let least-privilege apps (Sites.Selected only) provision groups and immediately manage their sites in one atomic step.

Additional context?

No response