Search code examples
pythonmicrosoft-graph-apiazure-ad-msal

File manipulation through Microsoft Graph API

I have an Excel inside a Sharepoint which I'm perfectly able to read making a call to Graph API from Python using msal library. I'm stuck in trying to update this file. I gave the application the Files.ReadWrite.All permission and I can see it decoding the token through jwt.ms:

{
    ...
    "roles": [
        "Files.ReadWrite.All"
    ]
    ...
}

These are the permissions of my application: App permissions

Despite this, when I try to send the PATCH http request to the file passing the structure to update I get a 403 AccessDenied error, it says that the operation can't be performed. It's not a problem of the structure I'm passing as it works fine in the Graph Explorer. It seems a permissions problem but I don't know which other permission might be missing...

How can I find out where the problem is?

UPDATE

Here's the code I'm using:

client instance generation:

client = msal.ConfidentialClientApplication(
    client_id
    ,authority = authority
    ,client_credential = client_secret
)

token request:

tk = client.acquire_token_for_client(scopes = ['https://graph.microsoft.com/.default'])

the simple HTTP request:

requests.request(
    method = 'PATCH'
    ,headers = {'Authorization': 'Bearer ' + tk['access_token']}
    ,url = 'https://graph.microsoft.com/v1.0/sites/{}/drive/items/{}/workbook/worksheets(\'{}\')/range(address=\'B2:C{}\')'.format(CONFIGS['app']['sharepoint_id'], CONFIGS['app']['workbook_id'], sheet, (CONFIGS['app']['nRows'] + 1))
    ,json = {...}
)

where json has a format like this (I'm emptying some cells):

{
    "values": [
        ["", ""]
    ],
    "formulas": [
        [null, null]
    ],
    "numberFormat": [
        [null, null]
    ]
}

UPDATE 2

I have set all readwrite permissions that exists on files API as you can see in this screenshot, still having a 403:

enter image description here

Solution

  • Based on the screenshot of your permissions, it looks like you need delegated permission Files.ReadWrite.All instead of application.

    I'm not sure about PATCH, according to the doc, you should send PUT request to update a content of the file

    Update:

    You are calling workbook API and this API doesn't support application permissions.