ExternalItem.ReadWrite.OwnedBy

Allows the app to read and write external items on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read external items of the connection that it is authorized to.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the ExternalItem.ReadWrite.OwnedBy permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	8116ae0f-55c2-452d-9944-d18420f5b2c8	4367b9d7-cee7-4995-853c-a0bdfe95c1f9
DisplayText	Read and write external items	Read and write external items
Description	Allows the app to read and write external items without a signed-in user. The app can only read external items of the connection that it is authorized to.	Allows the app to read and write external items on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read external items of the connection that it is authorized to.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /external/connections/{connectionId}/groups/{externalGroupId}/members/{identityId}
	DELETE /external/connections/{connectionsId}/groups/{externalGroupId}
	DELETE /external/connections/{connectionsId}/items/{externalItemId}
	GET /external/connections/{connectionsId}/groups/{externalGroupId}
	GET /external/connections/{connectionsId}/items/{externalItemId}
	PATCH /external/connections/{connectionsId}/groups/{externalGroupId}
	POST /external/connections/{connectionsId}/groups
	POST /external/connections/{connectionsId}/groups/{externalGroupId}/members
	POST external/connections/{connectionsId}/items/{externalItemId}/addActivities
	PUT /external/connections/{connection-id}/items/{item-id}

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /external/connections/{connection-id}/items/{item-id}
	DELETE /external/connections/{connectionId}/groups/{externalGroupId}
	DELETE /external/connections/{connectionId}/groups/{externalGroupId}/members/{externalGroupMemberId}
	GET /external/connections/{connection-id}/items/{item-id}
	POST /external/connections/{connectionId}/groups
	POST /external/connections/{connectionsId}/groups/{externalGroupId}/members
	POST external/connections/{connectionsId}/items/{externalItemId}/addActivities
	PUT /external/connections/{connection-id}/items/{item-id}

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Add-MgExternalConnectionItemActivity
	Get-MgBetaExternalConnectionItem
	Get-MgExternalConnectionGroup
	New-MgExternalConnectionGroup
	New-MgExternalConnectionGroupMember
	Remove-MgExternalConnectionGroup
	Remove-MgExternalConnectionGroupMember
	Remove-MgExternalConnectionItem
	Set-MgExternalConnectionItem
	Update-MgExternalConnectionGroup

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Add-MgBetaExternalConnectionItemActivity
	Get-MgBetaExternalConnectionItem
	New-MgBetaExternalConnectionGroup
	New-MgBetaExternalConnectionGroupMember
	Remove-MgBetaExternalConnectionGroup
	Remove-MgBetaExternalConnectionGroupMember
	Remove-MgBetaExternalConnectionItem
	Set-MgBetaExternalConnectionItem

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: acl

Property	Type	Description
accessType	microsoft.graph.externalConnectors.accessType	The access granted to the identity. Possible values are: `grant`, `deny`, `unknownFutureValue`.
type	microsoft.graph.externalConnectors.aclType	The type of identity. Possible values are: `user`, `group`, `everyone`, `everyoneExceptGuests`, `externalGroup`, `unknownFutureValue`.
value	String	The unique identifer of the identity. For Microsoft Entra identities, `value` is set to the object identifier of the user, group or tenant for types user, group and everyone (and everyoneExceptGuests) respectively. For external groups `value` is set to the ID of the externalGroup

Graph reference: externalActivity

Property	Type	Description
startDateTime	DateTimeOffset	The date and time when the particular activity occurred. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`.
type	microsoft.graph.externalConnectors.externalActivityType	The type of activity performed. The possible values are: `viewed`, `modified`, `created`, `commented`, `unknownFutureValue`.

Graph reference: externalActivityResult

Property	Type	Description
error	microsoft.graph.publicError	Error information that explains the failure to process an external activity.
startDateTime	DateTimeOffset	The date and time when the particular activity occurred. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Inherited from externalActivity.
type	microsoft.graph.externalConnectors.externalActivityType	The type of activity performed. The possible values are: `viewed`, `modified`, `created`, `commented`, `unknownFutureValue`. Inherited from externalActivity.

Graph reference: externalConnection

Property	Type	Description
activitySettings	microsoft.graph.externalConnectors.activitySettings	Collects configurable settings related to activities involving connector content.
configuration	microsoft.graph.externalConnectors.configuration	Specifies additional application IDs that are allowed to manage the connection and to index content in the connection. Optional.
connectorId	String	The Teams app ID. Optional.
description	String	Description of the connection displayed in the Microsoft 365 admin center. Optional.
id	String	Developer-provided unique ID of the connection within the Microsoft Entra tenant. Must be between 3 and 32 characters in length. Must only contain alphanumeric characters. Cannot begin with `Microsoft` or be one of the following values: `None`, `Directory`, `Exchange`, `ExchangeArchive`, `LinkedIn`, `Mailbox`, `OneDriveBusiness`, `SharePoint`, `Teams`, `Yammer`, `Connectors`, `TaskFabric`, `PowerBI`, `Assistant`, `TopicEngine`, `MSFT_All_Connectors`. Required.
name	String	The display name of the connection to be displayed in the Microsoft 365 admin center. Maximum length of 128 characters. Required.
searchSettings	microsoft.graph.externalConnectors.searchSettings	The settings configuring the search experience for content in this connection, such as the display templates for search results.
state	microsoft.graph.externalConnectors.connectionState	Indicates the current state of the connection. Possible values are: `draft`, `ready`, `obsolete`, `limitExceeded`, `unknownFutureValue`.

Graph reference: externalGroup

Property	Type	Description
description	String	The description of the external group. Optional.
displayName	String	The friendly name of the external group. Optional.
id	String	The unique ID of the external group within a connection. It must be alphanumeric and can be up to 128 characters long.

Graph reference: externalGroupMember

Property	Type	Description
id	String	The unique ID of the member. It would be the objectId for Microsoft Entra users or groups and the id property of the externalGroup for external groups.
type	microsoft.graph.externalConnectors.externalGroupMemberType	The type of member added to the external group. Possible values are: `user` or `group` when the identitySource is `azureActiveDirectory` and just `group` when the identitySource is `external`.
identitySource	microsoft.graph.externalConnectors.identitySourceType	The identity source that the member belongs to. Possible values are: `azureActiveDirectory`, `external`.

Graph reference: externalItem

Property	Type	Description
acl	microsoft.graph.externalConnectors.acl collection	An array of access control entries. Each entry specifies the access granted to a user or group. Required.
content	microsoft.graph.externalConnectors.externalItemContent	A plain-text representation of the contents of the item. The text in this property is full-text indexed. Optional.
id	String	Developer-provided unique ID of the item within the containing externalConnection. Must be alphanumeric and a maximum of 128 characters. Required.
properties	microsoft.graph.externalConnectors.properties	A property bag with the properties of the item. The properties MUST conform to the schema defined for the externalConnection. Required.

Graph reference: externalItemContent

Property	Type	Description
type	microsoft.graph.externalConnectors.externalItemContentType	The type of content in the value property. Possible values are: `text`, `html`, `unknownFutureValue`. These are the content types that the indexer supports, and not the file extension types allowed.
value	String	The content for the externalItem. Required.

Graph reference: identity

Property	Type	Description
id	String	The unique ID of the identity. It would be the objectId property for Microsoft Entra users or groups and the id property of the externalGroup in the case of external groups.
type	microsoft.graph.externalConnectors.identityType	The type of identity. Possible values are: `user` or `group` for Microsoft Entra identities and `externalgroup` for groups in an external system.

Graph reference: schema

Property	Type	Description
baseType	String	Must be set to `microsoft.graph.externalConnector.externalItem`. Required.
properties	property collection	The properties defined for the items in the connection. The minimum number of properties is one, the maximum is 128.

Table of Contents

ExternalItem.ReadWrite.OwnedBy

Graph Methods

Resources