Search code examples
microsoft-graph-apionedrive

Query Files of another One Drive for Business User's Files using MS Graph API as Global Admin

I can query my own One Drive for Business account files as 'The Global Admin' using Microsoft Graph API. I cannot query another One Drive for Business user's files as 'The Global Admin' using Microsoft Graph API.

Own Files: https://graph.microsoft.com/v1.0/me/drive/root/children

Another User: https://graph.microsoft.com/v1.0/users/xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx/drive/root/children

I am using an Azure AD registered app with following Application permissions:

  • Files.ReadWrite.All
  • Sites.Read.All
  • Sites.ReadWrite.All
  • User.ReadWrite.All
  • offline_access

However, when I go to Office 365 Admin and Choose that another One Drive for Business user (for which I could not query files using MS Graph API) => OneDrive => Get access to files => Click Create link files then I can successfully query that another user's files using MS Graph API.

One Drive for Business User

If Global Admin needs to query files of all user accounts using MS Graph API when there are 100s of users then this method might not be practical.

Is there any easier way or programmatically possible to give Global Admin the permissions to query files of all user accounts using MS Graph API. If yes, how do we do that.

Thanks!

Solution

  • As you've observed, a tenant admin cannot implicitly access any user's content. You have the power to grant yourself that access but that is cumbersome to do at scale. If you're a tenant admin you have another option though - use an "app-only" (i.e. application permissions) token. You'll have to consent the app for your tenant, but after that it can access content across your tenancy.