Auto-grant Sites.Selected access to the SP site created when provisioning a Microsoft 365 Group

When a site collection is created directly via POST /sites with the Sites.Create.All permission, the calling application is automatically granted Sites.Selected + FullControl on that new site collection — no extra step required (confirmed here: https://devblogs.microsoft.com/microsoft365dev/sharepoint-site-creation-in-microsoft-graph/).

However, this auto-grant does not extend to the SharePoint site that gets provisioned automatically when a Microsoft 365 Group is created via POST /groups. An app that only holds Sites.Selected (not tenant-wide Sites.ReadWrite.All) can successfully create the group, but has no access to the group's backing site afterwards — even though it was the app itself that triggered the site's creation. The only current workaround is a manual follow-up call to POST /sites/{site-id}/permissions to grant the app write access to that site, which adds an extra step, an extra failure point, and potential race conditions (the backing site is not always immediately available/addressable right after group creation).

Request: extend the existing Sites.Create.All → Sites.Selected auto-grant behavior to also cover the case where a site is provisioned indirectly, as a side effect of Microsoft 365 Group creation. If an app has the rights to create the group, it should be automatically granted Sites.Selected + write access to the site that gets created along with it — consistent with how direct site creation already works.

This would let apps that follow least-privilege practice (Sites.Selected only, no Sites.ReadWrite.All) provision groups and immediately manage their sites in one atomic step, without a manual permission-grant call or having to poll/retry for the site to become available.