Microsoft Graph app-only: link.webUrl omitted unless Sites.FullControl.All is granted

Our application uses Microsoft Graph with app-only authentication (client credentials) to retrieve sharing permissions for DriveItems stored in OneDrive for Business / SharePoint Online.

We retrieve permissions using:

GET https://graph.microsoft.com/v1.0/drives/{drive-id}/items/{item-id}/permissions

The request succeeds with 200 OK, and the sharing permissions are returned. However, for permissions containing a link facet, the link.webUrl property is omitted.

Environment

• Microsoft Graph
• App-only authentication / application permissions
• OneDrive for Business / SharePoint Online
• Application permissions:
  • Files.ReadWrite.All
  • Sites.ReadWrite.All

According to the List sharing permissions documentation:

Sharing permission properties that contain secrets (for example, shareId and webUrl) are only returned for callers that are able to create the sharing permission.

The Create sharing link documentation lists the following application permissions:

Least privileged: Files.ReadWrite.All

Higher privileged: Sites.ReadWrite.All

Since the application has both permissions, I would expect it to be considered able to create sharing permissions and therefore receive link.webUrl.

After i granted Sites.FullControl.All to the app the same request returned link.webUrl as expected.

Because Sites.FullControl.All provides significantly broader access, we would prefer not to grant it unless it is actually required.

Troubleshooting performed

I tested both Microsoft Graph versions:

v1.0

beta

I also tested both:

GET /drives/{drive-id}/items/{item-id}/permissions

and:

GET /drives/{drive-id}/items/{item-id}/permissions/{permission-id}

The behavior is consistent across all four cases.

Is Sites.FullControl.All currently expected to be required for an app-only request to recieve link.webUrl, despite Files.ReadWrite.All / Sites.ReadWrite.All being sufficient to create sharing links according to the documentation?

If Sites.FullControl.All is not intended to be required, is there a supported way to retrieve link.webUrl using the documented lower-privilege application permissions?