OneDrive API - Restring Folder/File Access

Question

I am working on POC to upload Application/User(not AD users) documents to OneDrive. For that I have created App(App registration) and given Files/User.ReadWrite.All Permission(API Permission) and given Admin Consent. I am able to Upload/Read/Delete document(s). Since i have given User.ReadWrite.All permission, API can read any AD User onedrive account. Could you let me know how to restrict access to a particular folder and do not allow API to manage other users onedrive data.

Regards,
Sri

Answer 1

Hi @Sri ,

Currently application permissions can be restricted to selected user's OneDrive for Business site or SharePoint Site collection level but not at individual drive or folder or file level. Since User's OneDrive for Business account is also one of the SharePoint sites, so you can levarage Create Site Permision Microsoft Graph API to set the restricted access/permissions on the required user's OneDrive site. With this approach , you can be able to reduce your application permission to "Files.Read.All""Sites.Seleted" instead of the current permissions "Files.ReadWrite.All". This way your application will have better control and restricted access on the user's OneDrive sites.

1. Fetch SharePoint Site ID of required user's OneDrive based on URL as shown below : GET https://graph.microsoft.com/v1.0/sites/{hostname}:/{server-relative-path}

Exampe : GET https://graph.microsoft.com/v1.0/sites/o365XXXX-my.sharepoint.com:/personal/demouser_o365XXXX_onmicrosoft_com

2.Create Site Permisson on this Site , so that application can only be able to make changes to this user's OneDrive site only. Please note that SharePoint Administratior can be able execute the below Graph API as it needs admin privileges to executed it.

 POST https://graph.microsoft.com/v1.0/sites/{sitesId}/permissions  

Example : POST https://graph.microsoft.com/v1.0/sites/o365XXX-my.sharepoint.com,62ff78bb-123d-4b0b-920e-f3caa8fe0ff2,8a0fef8b-d7e5-472a-4565-12c6764f73db/permissions

Sample JSON Request Body :

{  
    "roles": [  
        "write"  
    ],  
    "grantedToIdentities": [  
        {  
            "application": {  
                "id": "a5085d68-1234-56fc-8ee9-60abe5424849",  
                "displayName": "Test App"  
            }  
        }  
    ]  
}  

Note : Please mentioned your app id and name in the above request body and here roles can be "write" or "read".

Sources :

https://learn.microsoft.com/en-us/graph/api/site-post-permissions?view=graph-rest-1.0&tabs=http
https://learn.microsoft.com/en-us/graph/api/resources/permission?view=graph-rest-1.0
https://learn.microsoft.com/en-us/graph/api/site-get?view=graph-rest-1.0&tabs=http
https://devblogs.microsoft.com/microsoft365dev/controlling-app-access-on-specific-sharepoint-site-collections/

If the answer is helpful, please click "Accept Answer" and kindly upvote it ,so that it will be helpful to the other community users. If you have any further questions about this answer, please click "Comment".

Answer 2

Generally speaking the Graph API uses an "all or nothing" approach. That said, Microsoft is working on some methods to restrict this, such as the one outlined here: https://devblogs.microsoft.com/microsoft365dev/controlling-app-access-on-specific-sharepoint-site-collections/
Even though the article doesn't explicitly mention OneDrive, you can use it therein (assuming you mean OneDrive for Business).