Pre-provisioning OneDrive from a backend service: app-only, delegated, or PowerShell only? (macOS or only Windows available)

Goal

We provision Microsoft 365 accounts programmatically from a Rails backend using Microsoft Graph (POST /users, then POST /users/{id}/assignLicense). Each account is used to host Teams meetings that are transcribed.

Because Teams writes the transcript into the organizer's OneDrive, an account without a provisioned OneDrive silently loses every transcript: the meeting records, the upload fails, and GET /users/{id}/onlineMeetings/{id}/transcripts returns 200 with count: 0 — indistinguishable from "not indexed yet".

So we need OneDrive to exist before the user's first meeting, without waiting for them to sign in.

What we've tried

1. GET /users/{id}/drive with an app-only token

The docs say auto-provisioning happens "when using delegated authentication", and the permissions table lists Application: Not supported.

2. CreatePersonalSiteEnqueueBulk via SharePoint REST

POST https://{tenant}-admin.sharepoint.com/_api/sp.userprofiles.profileloader.getprofileloader/createpersonalsiteenqueuebulk

Here two docs appear to contradict each other:

• The endpoint reference says "My Site administrator on SharePoint Online only" — a user role requirement.
• SharePoint admin APIs authentication and authorization says admin API operations without a user are supported with Sites.FullControl.All on the SharePoint resource.

We also found this unanswered question where certificate-based app-only returned 200 OK and then "Attempted to perform an unauthorized operation" on the provisioning calls, while SetUserOneDriveQuota on the same token succeeded — suggesting the restriction is specific to personal-site provisioning rather than to app-only in general.

3. SharePoint Online Management Shell

Windows PowerShell only. Our whole team is on macOS and we have no Windows machines.

4. PnP PowerShell on macOS

Connect-PnPOnline -Interactive works. But Request-PnPPersonalSite's documentation lists application permissions while also requiring "the running account must have at least the SharePoint Administrator role and must have a SharePoint Online license", and community reports say certificate auth throws unauthorized against it and it still expects ClientId + ClientSecret — i.e. Azure ACS, which was retired on 2 April 2026.

What we're actually asking

Our core need is narrow: provision a user's OneDrive before they ever sign in, triggered from a backend service.

Our strong preference is to do this over REST — no human in the loop, no interactive session.

Everything above is us trying to work out which of the available paths actually supports that. The questions below are ordered from the option we'd most like to work down to the one we'd accept as a fallback.

Questions

1. Can CreatePersonalSiteEnqueueBulk be called app-only? This is the outcome we want. If yes, which exact permission and credential type, given that a client secret is not accepted for SharePoint APIs and a certificate is required? (Using the SharePoint REST service)

2. Is there any Graph-only, app-only way to trigger personal-site provisioning today? A single Graph call would be far preferable to reaching into the SharePoint REST service.

3. If delegated is the only option, which permission? SharePoint AllSites.FullControl, or something narrower? And is a stored refresh token from a service account holding the SharePoint Administrator role the intended pattern for unattended, recurring use? If so, how is the 90-day refresh-token lifetime expected to be handled for a process that may run less often than that?

4. With SPO Management Shell being Windows-only and ACS retired what is the supported 2026 path for a macOS/Linux team or a non-.NET backend? Is PnP PowerShell with interactive authentication the only remaining option?