Microsoft Graph API does not return SharePoint list items in “Pending” (content approval) state when using app-only authentication

Question

I am building an approval workflow using Azure Logic Apps + Microsoft Graph API (app-only authentication) to process documents stored in a SharePoint Online document library that has:

• Versioning enabled
• Content approval enabled
• Require check-out enabled

I retrieve documents from a SharePoint document library and process those where: ApprovalFlowState = 'NotStarted'

I am using Microsoft Graph API with an Azure AD App Registration and client credential flow: GET https://graph.microsoft.com/v1.0/sites/{site-id}/lists/{list-id}/items?$expand=fields&$top=50

Authentication is configured using:

• App Registration (client ID + secret)
• Application permissions:
  • Sites.ReadWrite.All (admin consent granted)

The API successfully returns list items and metadata.

However, only documents with: ApprovalFlowState = Completed

PROBLEM:

Documents that are:

• Newly uploaded
• Checked in
• In Pending approval state
• Have ApprovalFlowState = NotStarted

are NOT returned in the Graph API response, even though:

• They are visible in the SharePoint UI
• They are checked in
• They exist in the same document library

1. Is this expected behavior for Microsoft Graph when querying SharePoint lists with content approval enabled?
2. Is there any supported way to retrieve draft / pending items via Graph API?
3. Does Graph operate under a “published items only” visibility model for SharePoint libraries?
4. Would switching to SharePoint REST API or Power Automate connector be required to access pending items?

Answer 1

Yes, this behavior is expected when content approval and draft security are enabled, and it is controlled by SharePoint’s content approval and draft visibility settings rather than by the authentication method (user vs. app-only).

Key points from SharePoint content approval behavior:

• When Require content approval for submitted items is set to Yes, new or changed items are in Pending status until approved.
• While in Pending status, items are typically visible only to:
  • The item’s author, and
  • Users who can manage lists/libraries (for example, approvers or site owners), depending on the Draft Item Security setting.
• Draft/pending items can be hidden from general readers and from search/crawling accounts unless Draft Item Security is set to allow any user who can read items to see drafts.

From the documentation:

• Items in Pending status are visible only to the originator and people who can manage lists/libraries, unless security is configured to allow any user to read items, in which case all users with Read permissions can see them, regardless of approval status.
• Draft items are not crawled or visible to search unless Draft Item Security is set to Any user who can read items.

Given this:

1. Is this expected behavior for Microsoft Graph when querying SharePoint lists with content approval enabled?

Yes. When content approval is enabled and draft item security is restrictive, items in Pending (or draft) status are not exposed to callers that do not have visibility to drafts. This is consistent with how SharePoint controls visibility of pending items.

2. Is there any supported way to retrieve draft/pending items via Graph API?

Yes, but it depends on the library’s draft security configuration:

• In the library’s Versioning settings:
  • Ensure Require content approval for submitted items? is set as needed.
  • In Draft Item Security, choose Any user who can read items if draft/pending items must be visible to the calling principal.

When Any user who can read items is selected, draft items (including pending items) become visible to all readers, and this also allows the crawling account to see them. The same visibility rules apply to API callers.

3. Does Graph operate under a “published items only” visibility model for SharePoint libraries?

Graph respects SharePoint’s content approval and draft security model:

• If draft security is restrictive (for example, only approvers and authors can see drafts), Graph will effectively behave as if only approved/published items exist for principals that do not meet those conditions.
• If draft security is relaxed to Any user who can read items, Graph can return draft/pending items as long as the app principal has sufficient permissions.

4. Would switching to SharePoint REST API or Power Automate connector be required to access pending items?

Not necessarily. The underlying visibility rules are the same for:

• Microsoft Graph
• SharePoint REST API
• Power Automate connectors

If draft/pending items are hidden by content approval and draft security settings, switching APIs alone will not expose them. Instead, adjust the library’s Draft Item Security to Any user who can read items so that the app principal (with appropriate permissions) can see and retrieve pending items via Graph or other APIs.

---

References:

• Require approval of items in a list or library
• Draft items are not crawled in SharePoint
• Plan document versioning, content approval, and check-out controls in SharePoint
• Management and lifecycle of a SharePoint modern page