Is it possible to access Office 365 SharePoint/OneDrive API's with App-Only credentials for Multi-Tenant Azure App?

Question

We currently have a web service which is accessing the EWS API's for Mail, Calendar, and Contacts. For those, we used the "App-Only"/Client Credential flow to have an app-to-app auth.

Now we'd like to extend our web service to access the SharePoint/OneDrive API's. It looks like the preferred way to access these API's is by making a request to the Discovery service, however it seems that the Discovery service doesn't work with App-Only auth (see: Access Office 365 Discover Service with "app-only" token)

Another approach we've tried is to simply hard-code the SharePoint endpoint URL's.

* Connection #0 to host devunit1-my.sharepoint.com left intact
{
  "@odata.context": "https://devunit1-my.sharepoint.com/_api/v2.0/$metadata#me",
  "@odata.type": "#microsoft.coreServices.currentUserRequestContext",
  "@odata.id": "https://devunit1-my.sharepoint.com/_api/v2.0/me",
  "@odata.editLink": "me",
  "id": null
}

We can hit the server, but trying to access /files gives us an error:

{
  "error": {
    "code": "-1, Microsoft.Office.Server.UserProfiles.UserNotFoundException",
    "message": "User 'i:0i.t|00000003-0000-0ff1-ce00-000000000000|app@sharepoint' doesn't exist in UPA by UPN or SID, and user with this SID was not found in AD."
  }
}

The third way we've tried is by using the Office365 Unified API using /users/<OMITTED User.objectId>/drive which fails giving:

{"odata.error"=>{"code"=>"Request_ResourceNotFound", "message"=>{"lang"=>"en", "value"=>"Resource 'drive' does not exist or one of its queried reference-property objects are not present."}}}

Is there something that we're doing wrong? Is it possible to access SharePoint/OneDrive data (either through the Files API or some other API) with App-Only credentials? If not, is there some work around we can use or do we have to create an entirely separate auth flow just to use the Discovery service?

try something like this "devunit1-my.sharepoint.com/_api/v2.0/me/drive/items" — cozmin-calin
Josh, this isn't something that the OneDrive / Files API supports right now. It only works in the context of a user. However, adding app-delegated permissions support is on our backlog. — Ryan Gregg
@RGregg thanks for the response, that's what our research was telling us too and I wanted to confirm — Josh Bodah
@RyanGregg did you get to implement it by now? this feature is also extremely important for us as well — Nadav
@Nadav I didn't work on the feature using this, but I'm almost certain that it's implemented now as we support products for each of these APIs — Josh Bodah

umb-fla umb-fla · Accepted Answer · 2015-10-15T07:42:43

When working with SharePoint Designer Workflow on SharePoint Online (Office 365) and trying to access to User Profile Service (UPS) make sure you follow the instructions on the following post by providing the Workflow App the necessary permission to the UPS, but make sure you don't run the REST call in an App Step, this caused me a lot of Troubleshooting time as I was getting the error mentioned above "...app@sharepoint doesn't exist in UPA by UPN or SID, and user with this SID was not found in AD."

http://sharepoint-community.net/profiles/blogs/retrieving-user-profile-properties-in-a-sharepoint-2013-workflow

I hope it helps you too. Have fun.

Is it possible to access Office 365 SharePoint/OneDrive API's with App-Only credentials for Multi-Tenant Azure App?

1 Answers