Files.ReadWrite.AppFolder on personal OneDrive: 200 for drive-root metadata

Question

Files.ReadWrite.AppFolder on personal OneDrive: 200 for drive-root metadata

Igor Kolodin 0

In a delegated Microsoft Graph flow for a personal Microsoft account, the token response reported exactly Files.ReadWrite.AppFolder and User.Read. Reading a synthetic file inside the app folder succeeded. A separate GET https://graph.microsoft.com/v1.0/me/drive/root?$select=id returned HTTP 200. Our client canceled the response body without parsing it; it did not list root children or access any file outside the app folder.

Is HTTP 200 for the root driveItem metadata expected with Files.ReadWrite.AppFolder? Does this scope still prevent listing, downloading, and modifying items outside the app folder for a personal OneDrive account? Which endpoint and expected result does Microsoft recommend for a safe negative authorization check using only synthetic data? The generic Get driveItem permission table does not list AppFolder, while the AppFolder guide says the service limits file access to that folder.

Igor Kolodin 0 Reputation points

2026-09-25T18:55:03.2466667+00:00

With a personal OneDrive account and delegated Files.ReadWrite.AppFolder plus User.Read, our app can read and SHA-256-verify a synthetic file inside its AppFolder. The same one-time token received HTTP 404 for GET /me/drive/root:/synthetic-public-file.txt:/content. The synthetic file was independently visible and openable at the personal OneDrive root. We recorded only the HTTP status and did not follow a redirect or read the outside file response.

Is 404 an expected response for an existing file outside the AppFolder when this is the only file permission? Does Graph intentionally use 404 instead of 403 in this case? Is there a documented way to distinguish scope denial from path-not-found without granting broader file permissions?

Your answer

Igor Kolodin 0 Reputation points

2026-09-25T18:55:03.2466667+00:00

With a personal OneDrive account and delegated Files.ReadWrite.AppFolder plus User.Read, our app can read and SHA-256-verify a synthetic file inside its AppFolder. The same one-time token received HTTP 404 for GET /me/drive/root:/synthetic-public-file.txt:/content. The synthetic file was independently visible and openable at the personal OneDrive root. We recorded only the HTTP status and did not follow a redirect or read the outside file response.

Is 404 an expected response for an existing file outside the AppFolder when this is the only file permission? Does Graph intentionally use 404 instead of 403 in this case? Is there a documented way to distinguish scope denial from path-not-found without granting broader file permissions?