Modifica

Condividi tramite

Permissions for OneDrive API

  • Articolo

OneDrive and SharePoint expose a few granular permissions that control the access that apps have to resources. When a user signs in to your app they, or, in some cases, an administrator, are required to consent to these permissions. If consent is given, your app is given access to the resources and APIs that it has requested. For apps that don't take a signed-in user, permissions can be pre-consented to by an administrator when the app is installed or during sign-up.

For more details about the full set of Microsoft Graph permissions, please see Permissions reference for Microsoft Graph.

Files permissions

Delegated permissions

Permission Display String Description Admin Consent Required
Files.Read Read user files Allows the app to read the signed-in user's files. No
Files.Read.All Read all files that user can access Allows the app to read all files the signed-in user can access. No
Files.ReadWrite Have full access to user files Allows the app to read, create, update, and delete the signed-in user's files. No
Files.ReadWrite.All Have full access to all files user can access Allows the app to read, create, update, and delete all files the signed-in user can access. No
Files.ReadWrite.AppFolder Have full access to the application's folder (preview) (Preview) Allows the app to read, create, update, and delete files in the application's folder. No
Files.Read.Selected Read files that the user selects Limited support in Microsoft Graph - see Remarks
(Preview) Allows the app to read files that the user selects. The app has access for several hours after the user selects a file.		 No
Files.ReadWrite.Selected Read and write files that the user selects Limited support in Microsoft Graph -- see Remarks
(Preview) Allows the app to read and write files that the user selects. The app has access for several hours after the user selects a file.		 No

Application permissions

Permission Display String Description Admin Consent Required
Files.Read.All Read files in all site collections Allows the app to read all files in all site collections without a signed in user. Yes
Files.ReadWrite.All Read and write files in all site collections Allows the app to read, create, update, and delete all files in all site collections without a signed in user. Yes

Remarks

The Files.Read, Files.ReadWrite, Files.Read.All, and Files.ReadWrite.All delegated permissions are valid on both personal Microsoft accounts and work or school accounts. Note that for personal accounts, Files.Read and Files.ReadWrite also grant access to files shared with the signed-in user.

The Files.Read.Selected and Files.ReadWrite.Selected delegated permissions are only valid on work or school accounts and are only exposed for working with Office 365 file handlers (v1.0). They should not be used for directly calling Microsoft Graph APIs.

The Files.ReadWrite.AppFolder delegated permission is only valid for personal accounts and is used for accessing the App Root special folder with the OneDrive Get special folder Microsoft Graph API.

Example usage

Delegated

  • Files.Read : Read files stored in the signed-in user's OneDrive (GET /me/drive/root/children)
  • Files.Read.All : Read files shared with the signed-in user (GET /me/drive/root/sharedWithMe)
  • Files.ReadWrite : Write a file in the signed-in user's OneDrive (PUT /me/drive/root/children/filename.txt/content)
  • Files.ReadWrite.All : Write a file shared with the user (PUT /users/rgregg@contoso.com/drive/root/children/file.txt/content)
  • Files.ReadWrite.AppFolder : Write files into the app's folder in OneDrive (PUT /me/drive/special/approot/children/file.txt/content)

Sites permissions

Delegated permissions

Permission Display String Description Admin Consent Required
Sites.Read.All Read items in all site collections Allows the app to read documents and list items in all site collections on behalf of the signed-in user. No
Sites.ReadWrite.All Read and write items in all site collections Allows the app to edit or delete documents and list items in all site collections on behalf of the signed-in user. No
Sites.Manage.All Create, edit, and delete items and lists in all site collections Allows the app to manage and create lists, documents, and list items in all site collections on behalf of the signed-in user. No
Sites.FullControl.All Have full control of all site collections Allows the app to have full control to SharePoint sites in all site collections on behalf of the signed-in user. Yes

Application permissions

Permission Display String Description Admin Consent Required
Sites.Read.All Read items in all site collections Allows the app to read documents and list items in all site collections without a signed in user. Yes
Sites.ReadWrite.All Read and write items in all site collections Allows the app to create, read, update, and delete documents and list items in all site collections without a signed in user. Yes
Sites.Manage.All Have full control of all site collections Allows the app to manage and create lists, documents, and list items in all site collections without a signed-in user. Yes
Sites.FullControl.All Create, edit, and delete items and lists in all site collections Allows the app to have full control to SharePoint sites in all site collections without a signed-in user. Yes

Remarks

Sites permissions are valid only on work or school accounts.

Example usage

Delegated

  • Sites.Read.All : Read the lists on the SharePoint root site (GET /v1.0/sites/root/lists)
  • Sites.ReadWrite.All : Create new list items in a SharePoint list (POST /v1.0/sites/root/lists/123/items)
  • Sites.Manage.All : Add a new list to a SharePoint site (POST /v1.0/sites/root/lists)
  • Sites.FullControl.All : Complete access to SharePoint sites and lists.