Onedrive-api-docs: Permission Denied when using Graph API service to call Sharepoint with an Azure AD Guest account

[deck05]

My app is using Azure AD as an entry point to access both Sharepoint and website.

Good Case Scenario:
I login as an AD user, the app runs as it should. I can use both Graph Api and PNP SP to retrieve data from Sharepoint.

Issue:
If an external user (i.e. gmail, yahoo accounts) is used, the Graph Api throws permission denied error. I added the account on both the Azure AD and added it to the Sharepoint users. If I login to Sharepoint manually as an external user, the site will run perfectly fine. My guess is that the token that Graph API uses does not have the correct permissions to consume Sharepoint services. Can you please help?

Category

• [ ] Question
• [ ] Documentation issue
• [x] Bug

[msftbot[bot]]

Thank you for your contribution to OneDrive API Docs. We will be triaging your incoming issue as soon as possible.

[chackman]

The issue that you are encountering is not clear.

Please provide more information about what type of consent is used, what permissions it has been granted to in Microsoft Graph, and how the application is getting a token from AAD. Also are the expected permissions returned in the token?

[mahpour]

We use admin consent and we have Sites.Read.All, Sites.ReadWrite.All on SharePoint node. We get the tokens using code flow for Accessing Microsoft Graph APIs.

The problem is all calls work for internal organization users and token provided for those can perform all expected operations. The token is not provided when a guest AAD user which is invited into O365 group makes a request. It simply returns null. But if the same guest logs in to SharePoint UI directly once then the token is issued on next attempt and user can interact with SharePoint Graph API through our SPA app.

[chackman]

This sounds like a potential question for AAD. Could you please help clarify if I have understood the steps properly?

1. Your AAD application has specified a set of required permissions for the Microsoft Graph resource, including Sites.Read.All and Sites.ReadWrite.All permission scopes.
2. The admin has consented on behalf of all users in their organization.
3. The admin invites a new guest user to the organization.
   Question: how is the new guest user invited to the organization? Is it via the AAD portal, as referenced by the "Invite guests" topic here?
4. Your application gets a token with delegated permissions targeting the Microsoft Graph resource.
   4a. If the user is internal to the organization, then the token has the Sites.Read.All and Sites.ReadWrite.All permission scopes.
   4b. If the user is a guest user to the organization, and _has_ redeemed the invitation, then the token has the Sites.Read.All and Sites.ReadWrite.All permission scopes.
   4c. If the user is a new guest user to the organization, and _has not_ redeemed the invitation, then the token is empty.

[mahpour]

It’s almost correct.

1. We use SharePoint package for Azure AD to perform the guest invitations. Then we add those users to the Office 365 group that is linked to our particular SharePoint site group.

Step 4b. Is the scenario that guest users can authenticate via SSO but cannot access the SharePoint resources within that O365 group. But if they login to SharePoint UI directly using their guest account then they are able to access the SharePoint apis via Graph.

4c. Is not an issue since users don’t have a Microsoft account to pass authentication step.

[msftbot[bot]]

This issue has been automatically marked as stale because it has marked as requiring author feedback but has not had any activity for 10 days. It will be closed if no further activity occurs within 10 days of this comment. Thank you for your contributions to OneDrive API Docs!

[mahpour]

We have provided details on this issue and have not received any updates. @chackman has anyone looked at this ?

[chackman]

Sorry, the bot didn't notice since the author did not respond.
Have you verified that the token has the appropriate scopes?
If you have please provide the request ID and date/time as requested in the issue template.

[mahpour]

Yes, I don’t think the problem is about token, all internal org users can access the APIs with no problem. If the external user logs in to SharePoint interface directly once, then all API calls via graph or SharePoint APIs start working normally within our app domain. That’s very strange.

[chackman]

As requested in the issue template, please provide the request ID and date/time.

>

The following response headers would also be helpful if they are available:

• Date (in UTC, please)
• request-id
• SPRequestGuid (for requests made to OneDrive for Business)

This is required for us to assist you.

[mahpour]

Request is made via Sharepoint API with the Bearer token in the header.

Url: https://graph.microsoft.com/v1.0/sites/***.sharepoint.com,5c14b972-274c-4be8-a75c-89c11332e1d3,61d820a4-7d1c-48ac-a2e5-825d35ac751f/lists/Program%20List/items?$filter=&$select=fields&$expand=fields

Date: Wed, 24 Apr 2019 16:47:47 GMT
request-id: c73536c8-560c-429a-aff9-d6c9851341b0
I do not get the SPRequestGuid in the headers



md5-73eeb32a498027b3e4999b74f96f0c76



{
  "error": {
    "code": "accessDenied",
    "message": "There has been an error authenticating the request.",
    "innerError": {
      "request-id": "c73536c8-560c-429a-aff9-d6c9851341b0",
      "date": "2019-04-24T16:47:48"
    }
  }
}

@chackman does this help?

[chackman]

Yes, that should help.

[chackman]

Thanks for your feedback. This looks like a bug; we are currently investigating it further.

[Thibaultce]

I have the same issue as @mahpour : _If the external user logs in to SharePoint interface directly once, then all API calls via graph or SharePoint APIs start working normally within our app domain. That’s very strange._

Any update on that matter ?

[jeffcloudscale]

I can confirm this exact same issue. Also confirmed, after logging in via web, graph api auth started working again.... with the same token previously denied.

[jeffcloudscale]

I seem to have found a fix:
var result = await authContext.AcquireTokenAsync(resource, clientCred, userAssertion);
resource = 'https://[contoso].sharepoint.com'

Then make a simple request to Sharepoint with the token:
string.Format("{0}{1}/_api/web/lists(guid'{2}')/items({3})", [resource], [sitepath], listid);

This process wakes up the Sharepoint side of the authentication.
Now just make your graph call.

[gabrielnovoa]

You are probably receiving an Acces Denied message because Root Site Collection (https://tenant.sharepoint.com) has External Sharing Disabled. Try to select one of the options based on the following article: https://docs.microsoft.com/en-us/sharepoint/change-external-sharing-site

[ramumesh]

@gabrielnovoa We also having the same problem and I checked and verified that the "Root Site Collection (https://tenant.sharepoint.com) has External Sharing Disabled". But if this is the root cause, then all API calls via graph or SharePoint APIs should not work normally within our application when the external user once logs in to SharePoint interface directly.

[Bortronx]

I am experiencing the same issue.

When I use the GET request https://graph.microsoft.com/v1.0/sites/{sitename}.sharepoint.com in Microsoft Graph Explorer with an AD account I get an OK status and a response like this:

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#sites/$entity",
    "createdDateTime": "...",
    "description": "",
    "id": "...",
    "lastModifiedDateTime": "...",
    "name": "",
    "webUrl": "...",
    "displayName": "Communication site",
    "root": {},
    "siteCollection": {
        "hostname": "..."
       }
}

But when I make the same request using a guest account (that has access to the share point through the Sharepoint web interface in the website) it responds with a Not Found -404

{
    "error": {
        "code": "ResourceNotFound",
        "message": "Resource not found.",
        "innerError": {
            "date": "...",
            "request-id": "..."
        }
    }
}

[Thibaultce]

@chackman can we have an update on the bug ? It does not seem to be resolved.

[fainaszar]

We are facing same issue. If a guest user visits the sharepoint site via UI, they are able to access it but when we call it via Graph API it responds with "Resource Not Found", While it perfectly works for internal users.
@chackman Please update on the issue.

[Thibaultce]

Any chance to have some feedback from MS on this ?

[MSchutt]

I am also experiencing this same bug right now. Are there any statusupdates about this issue?