ExternalItem.Read.All

Allow the app to read external datasets and content, on behalf of the signed-in user.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the ExternalItem.Read.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	7a7cffad-37d2-4f48-afa4-c6ab129adcc2	922f9392-b1b7-483c-a4be-0089be7704fb
DisplayText	Read all external items	Read items in external datasets
Description	Allows the app to read all external items without a signed-in user.	Allow the app to read external datasets and content, on behalf of the signed-in user.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /external/connections/{connectionsId}/groups/{externalGroupId}
	GET /external/connections/{connectionsId}/items/{externalItemId}
	POST /search/query

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	GET /external/connections/{connection-id}/items/{item-id}
	POST /search/query

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgBetaExternalConnectionItem
	Get-MgExternalConnectionGroup
	Invoke-MgQuerySearch

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Get-MgBetaExternalConnectionItem
	Invoke-MgBetaQuerySearch

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: externalConnection

Property	Type	Description
activitySettings	microsoft.graph.externalConnectors.activitySettings	Collects configurable settings related to activities involving connector content.
configuration	microsoft.graph.externalConnectors.configuration	Specifies additional application IDs that are allowed to manage the connection and to index content in the connection. Optional.
connectorId	String	The Teams app ID. Optional.
description	String	Description of the connection displayed in the Microsoft 365 admin center. Optional.
id	String	Developer-provided unique ID of the connection within the Microsoft Entra tenant. Must be between 3 and 32 characters in length. Must only contain alphanumeric characters. Cannot begin with `Microsoft` or be one of the following values: `None`, `Directory`, `Exchange`, `ExchangeArchive`, `LinkedIn`, `Mailbox`, `OneDriveBusiness`, `SharePoint`, `Teams`, `Yammer`, `Connectors`, `TaskFabric`, `PowerBI`, `Assistant`, `TopicEngine`, `MSFT_All_Connectors`. Required.
name	String	The display name of the connection to be displayed in the Microsoft 365 admin center. Maximum length of 128 characters. Required.
searchSettings	microsoft.graph.externalConnectors.searchSettings	The settings configuring the search experience for content in this connection, such as the display templates for search results.
state	microsoft.graph.externalConnectors.connectionState	Indicates the current state of the connection. Possible values are: `draft`, `ready`, `obsolete`, `limitExceeded`, `unknownFutureValue`.

Graph reference: externalGroup

Property	Type	Description
description	String	The description of the external group. Optional.
displayName	String	The friendly name of the external group. Optional.
id	String	The unique ID of the external group within a connection. It must be alphanumeric and can be up to 128 characters long.

Graph reference: externalItem

Property	Type	Description
acl	microsoft.graph.externalConnectors.acl collection	An array of access control entries. Each entry specifies the access granted to a user or group. Required.
content	microsoft.graph.externalConnectors.externalItemContent	A plain-text representation of the contents of the item. The text in this property is full-text indexed. Optional.
id	String	Developer-provided unique ID of the item within the containing externalConnection. Must be alphanumeric and a maximum of 128 characters. Required.
properties	microsoft.graph.externalConnectors.properties	A property bag with the properties of the item. The properties MUST conform to the schema defined for the externalConnection. Required.

Graph reference: searchRequest

Property	Type	Description
aggregationFilters	String collection	Contains one or more filters to obtain search results aggregated and filtered to a specific value of a field. Optional. Build this filter based on a prior search that aggregates by the same field. From the response of the prior search, identify the searchBucket that filters results to the specific value of the field, use the string in its aggregationFilterToken property, and build an aggregation filter string in the format "{field}:\"{aggregationFilterToken}\"". If multiple values for the same field need to be provided, use the strings in its aggregationFilterToken property and build an aggregation filter string in the format "{field}:or(\"{aggregationFilterToken1}\",\"{aggregationFilterToken2}\")". For example, searching and aggregating drive items by file type returns a searchBucket for the file type `docx` in the response. You can conveniently use the aggregationFilterToken returned for this searchBucket in a subsequent search query and filter matches down to drive items of the `docx` file type. Example 1 and example 2 show the actual requests and responses.
aggregations	aggregationOption collection	Specifies aggregations (also known as refiners) to be returned alongside search results. Optional.
collapseProperties	collapseProperty collection	Contains the ordered collection of fields and limit to collapse results. Optional.
contentSources	String collection	Contains the connection to be targeted.
enableTopResults	Boolean	This triggers hybrid sort for messages : the first 3 messages are the most relevant. This property is only applicable to entityType=`message`. Optional.
entityTypes	entityType collection	One or more types of resources expected in the response. Possible values are: `event`, `message`, `driveItem`, `externalItem`, `site`, `list`, `listItem`, `drive`, `chatMessage`, `person`, `acronym`, `bookmark`. Use the `Prefer: include-unknown-enum-members` request header to get the following value(s) in this evolvable enum: `chatMessage`, `person`, `acronym`, `bookmark`. See known limitations for those combinations of two or more entity types that are supported in the same search request. Required.
fields	String collection	Contains the fields to be returned for each resource object specified in entityTypes, allowing customization of the fields returned by default; otherwise, including additional fields such as custom managed properties from SharePoint and OneDrive, or custom fields in externalItem from the content that Microsoft 365 Copilot connectors bring in. The fields property can use the semantic labels applied to properties. For example, if a property is labeled as title, you can retrieve it using the following syntax: `label_title`. Optional.
from	Int32	Specifies the offset for the search results. Offset 0 returns the very first result. Optional.
query	searchQuery	Contains the query terms. Required.
queryAlterationOptions	searchAlterationOptions	Query alteration options formatted in a JSON blob that contains two optional flags related to spelling correction. Optional.
region	String	The geographic location for the search. Required for searches that use application permissions. For details, see Get the region value.
resultTemplateOptions	resultTemplateOption collection	Provides the search result template options to render search results from connectors.
sharePointOneDriveOptions	sharePointOneDriveOptions	Indicates the kind of contents to be searched when a search is performed using application permissions. Optional.
size	Int32	The size of the page to be retrieved. The maximum value is 500. Optional.
sortProperties	sortProperty collection	Contains the ordered collection of fields and direction to sort results. There can be at most 5 sort properties in the collection. Optional.

Graph reference: searchResponse

Property	Type	Description
hitsContainers	searchHitsContainer collection	A collection of search results.
queryAlterationResponse	alterationResponse	Provides information related to spelling corrections in the alteration response.
resultTemplates	resultTemplate collection	A dictionary of resultTemplateIds and associated values, which include the name and JSON schema of the result templates.
searchTerms	String collection	Contains the search terms sent in the initial search query.

Table of Contents

ExternalItem.Read.All

Graph Methods

Resources