External OneDrive items access

Question

External OneDrive items access

Martin Tomek 1

In Azure Portal (business account) we created an app for OneDrive files and folders management via Graph API and granted both delegated and application permissions for required actions (create folder, list folder, upload file, etc.).

In some cases we need to use application permissions for these. When we try to e.g. list the folder stored on the drive within the same Azure AD, they all succeed.

But we need the app to be used from the external accounts as well. When I try to list the folder on my personal drive I get following error:
"The provided drive id appears to be malformed, or does not represent a valid drive."
(using endpoint https://graph.microsoft.com/v1.0/drives/{drive-id}/items/root/children)

The drive ID is correct (returned from /me/drive endpoint while using delegated permissions)
The app was allowed to do all the stuff for my personal account
Permissions are configured (Directory.ReadWrite.All, Files.ReadWrite.All, Sites.ReadWrite.All, User.ReadWrite.All)
Supported account types are "Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)"

Is there anything else where the app might be limited not to reach the external drive items? Or is the problem anywhere else?
Thank you for any advice!

1 answer

Your answer

Answer 1

RaytheonXie_MSFT 40,496 Microsoft External Staff

Hi @Martin Tomek
To share the item with external users, you will need to learn about external sharing features of Microsoft. Please refer to following document
https://learn.microsoft.com/en-us/sharepoint/external-sharing-overview
After share the item with external users, you can access the item by the graph api

GET /shares/{shareIdOrEncodedSharingUrl}

For more details you can refer to the following document
https://learn.microsoft.com/en-us/graph/api/shares-get?view=graph-rest-1.0&tabs=http

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Martin Tomek 1 Reputation point

2022-12-09T10:42:52.963+00:00
Thanks for your answer. I tried the practice as I understood the linked articles, but still cannot reach the shared item.

Using the delegated permissions of the owner of the drive item (folder) located on his personal onedrive I created the link for sharing:

POST /me/drive/items/{item-id}/createLink Content-Type: application/json { "type": "edit", "scope": "anonymous" }

The response was success with JSON object returned.

Then, using the application permission (the app from different Azure tenant) I tried to use the link:

GET /shares/{shareIdOrEncodedSharingUrl}

I tried the "id", "shareId" and "link.webUrl" (properly encoded) obtained from the response above, but all the options led to following error:

Resource not found for the segment 'shares'.

At the moment I am stucked here since I have not been able to find anything related to my case with this error message. Do you have idea what am I doing wrong?
RaytheonXie_MSFT 40,496 Reputation points Microsoft External Staff

2022-12-13T08:33:50.803+00:00

Hi @Martin Tomek
Per my test, I got the same result as yours on my end. Currently, the GET /shares/{shareIdOrEncodedSharingUrl} endpoint can only get shared DriveItems in the same tenant.

As a workaround, you could use https://graph.microsoft.com/v1.0/me/drive/sharedwithme?allowexternal=true to list the items shared with me, it would conatain external items.
Martin Tomek 1 Reputation point

2022-12-15T07:32:01.463+00:00
Hi @RaytheonXie_MSFT ,

thanks, but I suppose the suggested workaround can be used for the opposite scenario from mine. I have personal drive and try to access its items with the Azure app related to different tenant using application permissions. When I try the SharedWithMe endpoint I get this error:

/me request is only valid with delegated authentication flow.

Is there a way how to send the permission to a specific app? I was able to find a way only by email address (using Invite endpoint) but the app does not have one, or at least I cannot find it. (The same process using Google Drive API can succeed as there the apps do have the email addresses.)

Thanks, Martin
RaytheonXie_MSFT 40,496 Reputation points Microsoft External Staff

2022-12-22T05:56:17.517+00:00

Hi @Martin Tomek
Per my research, the only way to share external item by graph is to create a sharelink currently. As far as I know, there is no such function except create a sharelink
Tong Zhang_MSFT 9,261 Reputation points

2022-12-26T06:05:35.113+00:00

Hi @Martin Tomek ,

Do you have any further questions about this thread? If you have any questions or progress, you can contact me in time.
Martin Tomek 1 Reputation point

2022-12-28T07:20:12.027+00:00

Hi @Tong Zhang_MSFT

thanks for asking, I still have my original question unanswered since the lead from Raytheon was not usable for my case. I need to share the drive items with the Azure app from another tenant and I am stuck here, I tried everything related I had found but did not work for me so far. If you can share any other hint, I would appreciate that.

Thanks, Martin

Share via

External OneDrive items access

1 answer

Your answer