eDiscovery export download returns 302 to login with app-only token — is app-only download supported?

Oh, Jeongbin 0 Reputation points
2026-09-10T18:20:24.8433333+00:00 
Hello Microsoft Support,

We automate a Purview eDiscovery (Premium) review-set export via Microsoft Graph v1.0 using
**app-only authentication** (certificate client_credentials, no signed-in user;
application permission eDiscovery.ReadWrite.All). The whole pipeline succeeds and the export
operation completes — but we cannot download the result.

The finished export only provides exportFileMetadata[].downloadUrl, hosted at
`nam.proxyservice.ediscovery.svc.cloud.microsoft` (the base64 payload contains
`"IsDirectDownloadProxy": true`). When we GET that URL with our app-only token, we get a
**302 redirect to login.microsoftonline.com** — so the response is the Entra sign-in HTML
page (~67 KB), not the .zip/.pst. The export content is unreachable without a user login.

Details for tracing:
- Case: 74fa95f5-cb8f-4b9e-a226-f2fb7bfb197b
- Export operation: f16f5efe919c4b11982ac9ab9ee94277

Questions:
1. Is downloading eDiscovery export output supported with **app-only / application
   permissions**, or does the download proxy require a delegated user session?
2. If app-only isn't supported, does **Bring Your Own Storage (BYOS)** change the downloadUrl
   to a pre-authorized Azure Blob SAS that an app-only client can GET without a user token?
3. Is there any way to retrieve the export content without the login-gated proxy?

We have no service user account available, so a delegated flow isn't an option. Happy to
re-run and capture request-id/client-request-id if needed.
Microsoft Security | Microsoft Graph
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vasil Michev 127.8K Reputation points MVP Volunteer Moderator
    2026-09-10T19:20:49.3833333+00:00

    Afaik this is still only supported for delegate permissions. You can however automate that part, by following the instructions outlined in the official documentation:

    Note: If you need to perform an export operation, the response will include the download URL, file name, and size in the **exportfileMetadata property. You will be responsible for managing the actual download process. You can choose to download the file to your local computer or export it to your storage account. To automate the process and avoid the interactive sign-in page:

    1. Provision the Microsoft Purview eDiscovery application by using Create ServicePrincpal for the application ID b26e684c-5068-4120-a679-64a5d2c909d9.
    2. When the application is provisioned, request user-delegated permissions for discovery.Download.Read from the tenant admin. This request should be made from your third-party application interacting with Microsoft Graph.
    3. Make sure the tenant admin approves the request.
    4. Add the scope for the application to your existing script and make sure the headers include ("X-AllowWithAADToken", "true");. By following these steps, the user authorization process will be automated, and you won't encounter a manual interactive sign-in page.

    The part highlighted in bold is what confirms that only delegate permissions are supported.

    For a more detailed explanation on how to automate the process of downloading the export file(s) (via delegate permissions), check the bottom part of my article here: https://michev.info/blog/post/5806/using-the-graph-api-to-export-ediscovery-premium-datasets

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.