Can guests use MS Graph to pull documents from our SharePoint site ?

BetterSolutions.com 121

Hi,

We have watched the video and followed all the steps outlined here:
https://learn.microsoft.com/en-us/microsoft-365/solutions/collaborate-in-site?view=o365-worldwide

External Collaboration Settings in External Identities
SharePoint organization-level sharing settings
Created an Extranet Site
SharePoint site-level sharing settings
Added members to the Microsoft 365 Group

We have created a Single Page App that is registered under Azure App Registrations.
This App is using OAuth 2.0 Authorization Code Flow with PKCE.

Everything is working for Internal Users

Is it possible for External Users to pull documents from our SharePoint site using our App with MS Graph ?
The guest is currently signing in as themselves.

https://graph.microsoft.com/v1.0/sites/TENANT.sharepoint.com,   
f87eaf53-fhgh-4123-ggkk-d60hg86f767e,   
244g4gyj-7a2c-4fcf-8242-4t4ttey8261b   
/drive/root:/Document1.docx

Any help or suggestions would be really appreciated
thanks James

CarlZhao-MSFT 41,286 Reputation points

2022-01-12T01:45:52.577+00:00

Hi @BetterSolutions.com

Of course, external users can also use your app with MS Graph to pull documents from your SharePoint site, before that make sure you have added external users as guests to your tenant for collaboration.

1 answer

CarlZhao-MSFT 41,286 Reputation points

2022-01-12T02:13:40.807+00:00

Hi @BetterSolutions.com

Of course, external users can also use your app with MS Graph to pull documents from your SharePoint site, before that make sure you have added external users as guests to your tenant for collaboration. Also, be sure to use the /tenant id endpoint instead of the /common endpoint when you get the token to ensure your external users are logged in as guests of the tenant.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
BetterSolutions.com 121 Reputation points

2022-01-12T08:24:42.663+00:00

Hi @CarlZhao-MSFT

Thank you for the reply.

use the /tenant id endpoint instead of the /common endpoint when you get the token to ensure your external users are logged in as guests of the tenant.

I am not sure what the difference is between these these 2 endpoints.
I am assuming that we are using the /common endpoint

Let me do some reading up / searching online on this

many thanks

CarlZhao-MSFT 41,286 Reputation points

2022-01-12T08:48:41.2+00:00

Hi @BetterSolutions.com The /common endpoint defaults to making your external account log in as a personal account, and the /tenant id endpoint defaults to making your external account log in as an organizational work account. See this link.

BetterSolutions.com 121 Reputation points

2022-01-12T20:45:23.193+00:00

Thank you for the explanation.

Changing the URL endpoint from /common to /tenant-id has definitely helped.

If the external user uses the app they are getting:

{"error":{"code":"accessDenied",
"message":"There has been an error authenticating the request.",
"innerError":{"date":"2022-01-12T20:25:34","request-id":"ece2a08c-5622-4e96-92b1-05a2f1a50ed3","client-request-id":"ece2a08c-5622-4e96-92b1-05a2f1a50ed3"}}}

If the external user logs into SharePoint directly, they are able to access the file.

If the external user goes back and tries the App again, then the call is successful and there is no "access denied" error message.

Could it be something to do with the admin of the external user account having to consent on behalf of that user in that organization ?

Could you confirm that this known bug was resolved please ?

https://github.com/OneDrive/onedrive-api-docs/issues/1039

CarlZhao-MSFT 41,286 Reputation points

2022-01-13T07:23:44.633+00:00

Hi @BetterSolutions.com

Let me confirm with you:

You mean the external user must be logged in to the SharePoint portal before calling the api endpoint to pull document? If external user does not log in to the SharePoint portal and call the api endpoint, will report an error?

BetterSolutions.com 121 Reputation points

2022-01-13T12:58:41.013+00:00

Thanks for sticking with this.

The API endpoint didn't work and was throwing an "authentication access denied".

As soon as the external user logged into SharePoint the MS Graph API call to get a document started working.

I am following up with several users to determine if the MS Graph API call is continuing to work or whether it is going to rely on the user logging back into SharePoint again at some point (to help facilitate the authentication somehow).

CarlZhao-MSFT 41,286 Reputation points

2022-01-14T08:28:32.303+00:00

Hi @BetterSolutions.com

This may be an unknown bug. Have you tried calling the https://graph.microsoft.com/v1.0/sites/{siteId}/drive/items/{item-id}/content endpoint to pull the file?

BetterSolutions.com 121 Reputation points

2022-01-17T09:34:10.79+00:00

Many thanks - I will change the MS Graph call
from:

https://graph.microsoft.com/v1.0/sites/{siteid} /drive/root:/Document1.docx

to

https://graph.microsoft.com/v1.0/sites/{siteId} /drive/items/{item-id}

This does not seem to have made any difference.

Users are still having to sign in to the SharePoint site manually before the MS Graph API calls works

CarlZhao-MSFT 41,286 Reputation points

2022-01-18T01:41:31.703+00:00

Hi dear @BetterSolutions.com Would you please provide us with an update on the status of your issue?

BetterSolutions.com 121 Reputation points

2022-01-18T22:52:58.9+00:00

Hi @CarlZhao-MSFT ,

Our users are still having to sign in to our Extranet SharePoint site manually before the MS Graph API call works.

Could we try adding yourself as an external user and we could send you the manifest file to try ?

We could then troubleshoot and test together on a MS TEAMS call.

many thanks, James

BetterSolutions.com 121 Reputation points

2022-01-25T15:55:24.687+00:00

Hi @CarlZhao-MSFT ,

Could you confirm if users having to sign in to an Extranet SharePoint site manually before the MS Graph API call works is a known bug please ?

Could you confirm that this known bug was resolved please ?

https://github.com/OneDrive/onedrive-api-docs/issues/1039

CarlZhao-MSFT 41,286 Reputation points

2022-01-28T09:49:41.037+00:00

Hi @BetterSolutions.com

After many tests I think this may be an unknown bug, I will discuss it with my colleagues, if there is any progress I will update here.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Can guests use MS Graph to pull documents from our SharePoint site ?

1 answer

Your answer