ExternalConnection.ReadWrite.OwnedBy

Allows the app to read and write settings of external connections on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read and write settings of connections that it is authorized to.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the ExternalConnection.ReadWrite.OwnedBy permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	f431331c-49a6-499f-be1c-62af19c34a9d	4082ad95-c812-4f02-be92-780c4c4f1830
DisplayText	Read and write external connections	Read and write external connections
Description	Allows the app to read and write external connections without a signed-in user. The app can only read and write external connections that it is authorized to, or it can create new external connections.	Allows the app to read and write settings of external connections on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read and write settings of connections that it is authorized to.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /external/connections/{connectionsId}
	GET /external/connections
	GET /external/connections/{connectionsId}
	GET /external/connections/{connectionsId}/operations/{connectionOperationId}
	GET /external/connections/{connectionsId}/schema
	PATCH /external/connections/{connectionsId}
	PATCH /external/connections/{id}/schema
	POST /external/connections

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /external/connections/{id}
	GET /external/connections
	GET /external/connections/{connection-id}/operations/{operation-id}
	GET /external/connections/{id}
	GET /external/connections/{id}/quota
	GET /external/connections/{id}/schema
	PATCH /external/connections/{connectionId}/schema
	PATCH /external/connections/{id}
	PATCH /external/connections/{id}/schema
	POST /external/connections

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgExternalConnection
	Get-MgExternalConnectionOperation
	Get-MgExternalConnectionSchema
	New-MgExternalConnection
	Remove-MgExternalConnection
	Update-MgExternalConnection
	Update-MgExternalConnectionSchema

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgBetaExternalConnection
	Get-MgBetaExternalConnectionOperation
	Get-MgBetaExternalConnectionQuota
	Get-MgBetaExternalConnectionSchema
	New-MgBetaExternalConnection
	Remove-MgBetaExternalConnection
	Update-MgBetaExternalConnection
	Update-MgBetaExternalConnectionSchema

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: configuration

Property	Type	Description
authorizedAppIds	String collection	A collection of application IDs for registered Microsoft Entra apps that are allowed to manage the externalConnection and to index content in the externalConnection.

Graph reference: connectionOperation

Property	Type	Description
error	publicError	If `status` is `failed`, provides more information about the error that caused the failure.
id	String	Unique identifier for the connectionOperation. Read-only.
status	microsoft.graph.externalConnectors.connectionOperationStatus	Indicates the status of the asynchronous operation. Possible values are: `unspecified`, `inprogress`, `completed`, `failed`, `unknownFutureValue`.

Property	Type	Description
itemsRemaining	Int64	The minimum of two values, one representing the *i

Graph reference: externalConnection

Property	Type	Description
activitySettings	microsoft.graph.externalConnectors.activitySettings	Collects configurable settings related to activities involving connector content.
configuration	microsoft.graph.externalConnectors.configuration	Specifies additional application IDs that are allowed to manage the connection and to index content in the connection. Optional.
connectorId	String	The Teams app ID. Optional.
description	String	Description of the connection displayed in the Microsoft 365 admin center. Optional.
id	String	Developer-provided unique ID of the connection within the Microsoft Entra tenant. Must be between 3 and 32 characters in length. Must only contain alphanumeric characters. Cannot begin with `Microsoft` or be one of the following values: `None`, `Directory`, `Exchange`, `ExchangeArchive`, `LinkedIn`, `Mailbox`, `OneDriveBusiness`, `SharePoint`, `Teams`, `Yammer`, `Connectors`, `TaskFabric`, `PowerBI`, `Assistant`, `TopicEngine`, `MSFT_All_Connectors`. Required.
name	String	The display name of the connection to be displayed in the Microsoft 365 admin center. Maximum length of 128 characters. Required.
searchSettings	microsoft.graph.externalConnectors.searchSettings	The settings configuring the search experience for content in this connection, such as the display templates for search results.
state	microsoft.graph.externalConnectors.connectionState	Indicates the current state of the connection. Possible values are: `draft`, `ready`, `obsolete`, `limitExceeded`, `unknownFutureValue`.

Graph reference: schema

Property	Type	Description
baseType	String	Must be set to `microsoft.graph.externalConnector.externalItem`. Required.
properties	property collection	The properties defined for the items in the connection. The minimum number of properties is one, the maximum is 128.

Table of Contents

ExternalConnection.ReadWrite.OwnedBy

Graph Methods

Resources