2

I have a Logic App in which I want to get info/URLs for documents that match a certain query via HTTP request, and then looping over the results in a 'for each' to the read these documents using a Sharepoint task like 'Get file content'.

To do so, I see I have two options. First is the Graph API. Using this, I would have to request permissions for the Logic App system assigned managed identity. There is a guide for doing this that I already found.

However, I would much rather simply run a query to our company sharepoint using something like: https://mycompany.sharepoint.com/_api/search/query?querytext='Year:2022'. However, running this causes a 403 with Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically. Now this seems logical to me since the app has no type of authorization with the Sharepoint site whatsoever.

Next, I try with adding the system-assigned managed identity as authorization, but this also results in a 401, which is logical since the managed identity also doesn't have any rights. But also, I can't find if the managed identity would be a valid way to identify against the 'https://mycompany.sharepoint.com/_api/' and if so, how?

Actually, I can't really find any information on how to provide credentials to the search API, let alone from Logic App. Does anybody have any clue? This is how I want the app to look like and the settings for the HTTP request:

enter image description here

Tim
  • 147
  • 8
  • I don't think it would work with managed identity through the `_api/` endpoint. The token that would be returned from AAD to authenticate to the Sharepoint would not match. If you use client_id/secret this should work. I think the best option to use managed identity is through Graph API: grant permission to your managed identity to sharepoint then you could start query sharepoint through graph – Thomas Oct 16 '22 at 22:35
  • Nope, it looks like that is indeed the case. However, even with Graph API using the query endpoint is a non-possibility, and requires delegated permissions, which can't be done for the managed identity. Looks like I'll need a service account with an app registration! – Tim Oct 17 '22 at 07:29
  • you can use app permission for sharepoint through graph api: https://learn.microsoft.com/en-us/graph/permissions-reference#application-permissions-61. Then you can also use the graph api to query sharepoint: https://learn.microsoft.com/en-us/graph/api/resources/sharepoint?view=graph-rest-1.0 – Thomas Oct 17 '22 at 07:34

0 Answers0