Graph API: Cannot access external content

Chris Sommers 0 Reputation points
2024-09-28T17:18:33.72+00:00

Our Microsoft Tenant has a service account ("Service", service@email.com) with a OneDrive that external users share folders to from their OneDrive (and SharePoint).

We created an App Registration for our service account to access content from Service's OneDrive. We are able to list files and folders in Service's OneDrive for local files and content shared from other users within our tenant at email.com.

Further, we can view content shared from external users/tenants with the endpoint: https://graph.microsoft.com/v1.0/me/drive/sharedWithMe?allowexternal=true

However, when we try to access any content from the results of the above GET request, it always a returns a 404 with error code "itemNotFound" and message "Item not found".

The App Registration has Files.ReadWrite.All permissions.

Here is an excerpt from the JWT Token:

image.png

A user at an external tenant named Ricky shared a folder named "Product" with us, which has 10 children, including files and folders. We want to be able to view subfolder contents and download all files (and iterate through all subfolder content).

When we call shareWithMe, we see this (truncated):

User's image

We are trying to access this item via the following calls:

GET https://graph.microsoft.com/v1.0/drives/b!d63cOFEdZ0C23x1hbh1R8WDYGrkdsSZNsMqP1T13khbQLfTr_7o7S70WoGLKYP2B/items/01HO7ZX76AVQGHLXKBFJFYNNC3QQWFOZHI/children

GET https://graph.microsoft.com/v1.0/drives/b!d63cOFEdZ0C23x1hbh1R8WDYGrkdsSZNsMqP1T13khbQLfTr_7o7S70WoGLKYP2B/items/01HO7ZX76AVQGHLXKBFJFYNNC3QQWFOZHI/content

GET https://graph.microsoft.com/v1.0/drives/b!d63cOFEdZ0C23x1hbh1R8WDYGrkdsSZNsMqP1T13khbQLfTr_7o7S70WoGLKYP2B/items/01HO7ZX76AVQGHLXKBFJFYNNC3QQWFOZHI

We've tried the above endpoints with and without the "?allowexternal=true" parameter.

Every call we make returns with:

image.png

However, if we click on the web link, our user Service can access the files and folders through the browser, and view subfolder contents and download any content.

I've also tried this with other permutations of App Registrations with even higher privileges:

User's image

Azure
Azure
A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.
1,041 questions
Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
11,945 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.