Azure App Permissions : System.UnauthorizedAccessException Error

Question

I have an App Registered in the Azure Active Directory with api permissions
ExternalItem.read.All - Delegate (Graph)
sites.read.All - Application (Graph)

I am using this app to get data from the SharePoint via graph search API.

It was working fine until recently I am facing the below error.

"error": {
"code": "System.UnauthorizedAccessException",
"message": "Access to OneDriveFile in Graph API requires the following permissions: Files.Read.All, Sites.Read.All, Files.ReadWrite.All, Sites.ReadWrite.All. However, the application only has the following permissions granted: ExternalItem.Read.All, User.Read",
"target": ""
}

Any idea regarding the same?
Thanks

Answer 1

Guess it depends on what you are attempting to access.
But here is the OneDrive/SP reference :
https://learn.microsoft.com/en-us/onedrive/developer/rest-api/concepts/permissions_reference?view=odsp-graph-online

Answer 2

Hi @harryK9 ,

According to the error message:

"message": "Access to OneDriveFile in Graph API requires the following permissions: Files.Read.All, Sites.Read.All, Files.ReadWrite.All, Sites.ReadWrite.All. However, the application only has the following permissions granted: ExternalItem.Read.All, User.Read"

Please try to grant your app ** Files.Read.All **, ** Sites.Read.All **, ** Files.ReadWrite.All **, ** Sites.ReadWrite.All ** Delegated permissions.

More information for reference:
Microsoft Graph permissions reference
Use the Microsoft Search API to search OneDrive and SharePoint content
Working with SharePoint sites in Microsoft Graph

Hope it can help you. Thanks for your understanding.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

---

Answer 3

Hi @Tong Zhang_MSFT ,
Could you please tell all the listed permissions (Files.Read.All , Sites.Read.All , Files.ReadWrite.All , Sites.ReadWrite.All Delegated permissions) are required or anyone of them?

Thanks