Microsoft Graph DriveItem permissions no longer returning `link.webUrl`

Pranil Shrestha 0 Reputation points
2026-09-03T09:46:43.4733333+00:00

I’m working on a personal project that integrates with Microsoft Graph to inspect sharing permissions for OneDrive/SharePoint DriveItems.

Previously, when retrieving permissions for a DriveItem using:

GET /drives/{drive-id}/items/{item-id}/permissions

the response for a sharing-link permission included the link.webUrl property, for example:

{
  "id": "...",
  "roles": ["read"],
  "link": {
    "scope": "anonymous",
    "type": "view",
    "webUrl": "https://..."
  }
}

Recently, I started receiving the link object with properties such as scope and type, but webUrl is no longer returned, even though I know that the sharing link exists and is accessible through the DriveItem.

For example, I now receive something similar to:

{
  "id": "...",
  "roles": ["read"],
  "link": {
    "scope": "anonymous",
    "type": "view"
  }
}

According to the Microsoft Graph documentation, link.webUrl is supposed to contain the URL that opens the item in OneDrive/SharePoint.

Was there a recent change in Microsoft Graph that causes link.webUrl to be omitted in some circumstances?

If so:

  1. What permissions or authorization conditions are required for link.webUrl to be returned?
  2. Is this behavior different between delegated and application permissions?
  3. Is there an alternative Microsoft Graph API that can be used to retrieve the actual sharing URL for an existing permission?
  4. Is there a supported way to retrieve all sharing links associated with a DriveItem, including their URLs, scope, and type?

I’m particularly interested in retrieving all existing sharing links for a DriveItem for my personal project, rather than creating new sharing links.

Microsoft Security | Microsoft Graph
0 comments No comments

1 answer

Sort by: Most helpful
  1. Vasil Michev 127.8K Reputation points MVP Volunteer Moderator
    2026-09-03T12:22:50.7533333+00:00

    As the weburl is considered a secret, it will only be returned if the caller has sufficient permissions. Both delegate and application permissions behave in the same manner, so make sure the caller is listed as owner of the item, or the parent site/site collection.

    Here's the relevant quote from the documentation: https://learn.microsoft.com/en-us/graph/api/driveitem-list-permissions?view=graph-rest-1.0&tabs=http

    Sharing permission properties that contain secrets (e.g. shareId and webUrl) are only returned for callers that are able to create the sharing permission.

    Was this answer helpful?


Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.