sharepointmicrosoft-graph-apionedrive

Microsoft Graph API: Accessing Content Shared from External Sources


Our Microsoft Tenant has a service account ("Service", service@email.com) with a OneDrive that external users share folders to from their OneDrive (and SharePoint).

We created an App Registration for our service account to access content from Service's OneDrive. We are able to list files and folders in Service's OneDrive for local files and content shared from other users within our tenant at email.com.

Further, we can view content shared from external users/tenants with the endpoint: https://graph.microsoft.com/v1.0/me/drive/sharedWithMe?allowexternal=true

However, when we try to access any content from the results of the above GET request, it always a returns a 404 with error code "itemNotFound" and message "Item not found".

The App Registration has Files.ReadWrite.All permissions. Here is an excerpt from the JWT Token: jwt_token_permissions

A user at an external tenant named Ricky shared a folder named "Product" with us, which has 10 children, including files and folders. We want to be able to view subfolder contents and download all files (and iterate through all subfolder content).

When we call shareWithMe, we see this (truncated):

response_remote_items

We are trying to access this item via the following calls:

GET https://graph.microsoft.com/v1.0/drives/b!d63cOFEdZ0C23x1hbh1R8WDYGrkdsSZNsMqP1T13khbQLfTr_7o7S70WoGLKYP2B/items/01HO7ZX76AVQGHLXKBFJFYNNC3QQWFOZHI/children

GET https://graph.microsoft.com/v1.0/drives/b!d63cOFEdZ0C23x1hbh1R8WDYGrkdsSZNsMqP1T13khbQLfTr_7o7S70WoGLKYP2B/items/01HO7ZX76AVQGHLXKBFJFYNNC3QQWFOZHI/content

GET https://graph.microsoft.com/v1.0/drives/b!d63cOFEdZ0C23x1hbh1R8WDYGrkdsSZNsMqP1T13khbQLfTr_7o7S70WoGLKYP2B/items/01HO7ZX76AVQGHLXKBFJFYNNC3QQWFOZHI

We've tried the above endpoints with and without the "?allowexternal=true" parameter.

Every call we make returns with: error_code

However, if we click on the web link, our user Service can access the files and folders through the browser, and view subfolder contents and download any content.


Solution

  • I needed to use the other tenant's tenant ID when requesting the access token.