CODEWITHSUNDEEP
azure-active-directorymicrosoft-graph-apionedrive
crom87
crom87

Reputation: 1381

Microsoft Graph. Access OneDrive with application own identity

In a mobile application we are generating some images that we would like to upload to the client's cloud. The client is using OneDrive For Business, with all the 360 suite (I have no more information about it yet).

What we would like to do, is to be able to store the images in a OneDrive account, without the user having to sign in. All the documentation I found to authenticate to OneDrive includes an interactive sign-in process which we don't want: https://learn.microsoft.com/en-us/onedrive/developer/rest-api/getting-started/graph-oauth?view=odsp-graph-online

I have found that for Microsoft Graph there is the possibility of using the app's own identity to sign in (only REST), but it is not 100% clear to me that this authentication can grant access to OneDrive. https://learn.microsoft.com/en-us/graph/auth-v2-service

Since I am not familiar at all with Microsoft cloud infrastructure I would appreciate some info.

Is it actually possible to access a OneDrive folder authenticating with the app's own identity?

Upvotes: 1

Views: 1536

Answers (1)

Rohit Saigal
Rohit Saigal

Reputation: 9684

Yes it should be possible to work with Microsoft Graph API and One drive files using application identity (i.e. without a user sign-in)

REST API's that should help

Do know that there are many SDK's/Client Libraries available for Microsoft Graph API that you can work with depending on your platform. e.g. Microsoft Graph .NET Client Library. As you've mentioned Only REST, I'm giving links for direct REST APIs here.

  1. Uploading files (upto 4 MB) - Upload REST API

    Least permission required will be Files.ReadWrite.All (under application permissions and Admin consent will be required first for this application permission. In case you aren't familiar with consent process, take a look here: Azure AD Consent Framework and mention in comments, I can add a little more detail if needed)

    enter image description here

  2. Uploading larger files - Resumable Upload REST API

    enter image description here

Authentication

From a flow standpoint you will need to make use of OAuth 2.0 Client Credentials Grant Flow to authenticate

NOTE: Please do note that this flow is meant only for confidential clients. So you shouldn't make use of it directly from a mobile client or even desktop client (like WPF or console application), as these are public clients which can not securely handle client secrets. Your mobile client should call a backend API, that in turn can call Microsoft Graph and uses client secrets, acting like a daemon using Application permissions.

At the end of this link there are code samples available for .NET Core 2.1 and ASP.NET MVC.

Upvotes: 1

Related Questions