OneDrive SharedWithMe endpoint returns null

[ElisaKazan]

Expected behavior

The OneDrive SharedWithMe endpoint should return values for the files and folders that have been shared with the given user.

I should be seeing the files and folders that are shared with me in the values array.

Actual behavior

OneDrive SharedWithMe endpoint returns nothing in the graph explorer when there are files and folders that should appear.

This is what I'm given:
{ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#Collection(driveItem)", "value": [] }

Steps to reproduce the behavior

On the graph explorer, open Sample Queries and under OneDrive select the files shared with me query. In the Response Preview, values is in fact empty.

[MIchaelMainer]

I'm not seeing the same results as you. Let me know if this is still an issue for you and reopen this issue.

[ElisaKazan]

I think it may only happen with admin accounts? My personal work account displayed results but a test admin account showed these results:

This is what the Shared with Me has so I should be expecting some results.

[MIchaelMainer]

Who's the signed in user in that SharePoint Shared with me page? Is it Ed Admin and did Ed Admin share with themselves? Can you try having another user share a file with Ed Admin?

[ElisaKazan]

Sorry for the confusion, there are two admin test accounts and both are named Ed Admin.

I tried to share files from a non admin account to Ed Admin and they don't show up in Shared with Me at all, I just get the email stating "I shared some photos with you in OneDrive" along with the link.

I then shared 598e1e3b4d1255a3 from Mr 2FA (another admin account) to Ed Admin and that seemed to work.

This is the result of the query after. It now has the file from Mr 2FA but the other ones which have the icon I circled above seem to not be displayed. Is this just a limitation when a shared file is located outside the organization? That would explain why I was getting no results before because all the other files are from outside the organization.

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#Collection(driveItem)",
    "value": [
        {
            "@odata.type": "#microsoft.graph.driveItem",
            "createdDateTime": "2018-05-31T18:15:47Z",
            "id": "01GJIJIHHEJAOQLXONDFA3EPQYNJB4JYTN",
            "lastModifiedDateTime": "2018-05-31T18:15:48Z",
            "name": "598e1e3b4d1255a3.png",
            "webUrl": "https://globogym-my.sharepoint.com/personal/2fa_globogym_onmicrosoft_com/Documents/598e1e3b4d1255a3.png",
            "size": 2619,
            "createdBy": {
                "user": {
                    "email": "2fa@globogym.onmicrosoft.com",
                    "displayName": "Mr 2FA"
                }
            },
            "lastModifiedBy": {
                "user": {
                    "email": "2fa@globogym.onmicrosoft.com",
                    "displayName": "Mr 2FA"
                }
            },
            "file": {
                "mimeType": "image/png"
            },
            "fileSystemInfo": {
                "createdDateTime": "2018-05-31T18:15:47Z",
                "lastModifiedDateTime": "2018-05-31T18:15:48Z"
            },
            "remoteItem": {
                "createdDateTime": "2018-05-31T18:15:47Z",
                "id": "01GJIJIHHEJAOQLXONDFA3EPQYNJB4JYTN",
                "lastModifiedDateTime": "2018-05-31T18:15:48Z",
                "name": "598e1e3b4d1255a3.png",
                "size": 2619,
                "webDavUrl": "https://globogym-my.sharepoint.com/personal/2fa_globogym_onmicrosoft_com/Documents/598e1e3b4d1255a3.png",
                "webUrl": "https://globogym-my.sharepoint.com/personal/2fa_globogym_onmicrosoft_com/Documents/598e1e3b4d1255a3.png",
                "createdBy": {
                    "user": {
                        "email": "2fa@globogym.onmicrosoft.com",
                        "displayName": "Mr 2FA"
                    }
                },
                "file": {
                    "mimeType": "image/png"
                },
                "fileSystemInfo": {
                    "createdDateTime": "2018-05-31T18:15:47Z",
                    "lastModifiedDateTime": "2018-05-31T18:15:48Z"
                },
                "lastModifiedBy": {
                    "user": {
                        "email": "2fa@globogym.onmicrosoft.com",
                        "displayName": "Mr 2FA"
                    }
                },
                "parentReference": {
                    "driveId": "b!_ULX_RLAtECrgJLx6kcPChr0PVj8OdBMu_jW9hxZNjg_uqDzNYqPS4tmaoQTwLWI",
                    "driveType": "business",
                    "id": "01GJIJIHF6Y2GOVW7725BZO354PWSELRRZ"
                },
                "shared": {
                    "scope": "users",
                    "sharedDateTime": "2018-05-31T18:16:21Z",
                    "sharedBy": {
                        "user": {
                            "email": "2fa@globogym.onmicrosoft.com",
                            "displayName": "Mr 2FA"
                        }
                    }
                },
                "sharepointIds": {
                    "listId": "f3a0ba3f-8a35-4b8f-8b66-6a8413c0b588",
                    "listItemId": "2",
                    "listItemUniqueId": "051d48e4-cddd-4119-b23e-186a43c4e26d",
                    "siteId": "fdd742fd-c012-40b4-ab80-92f1ea470f0a",
                    "siteUrl": "https://globogym-my.sharepoint.com/personal/2fa_globogym_onmicrosoft_com",
                    "webId": "583df41a-39fc-4cd0-bbf8-d6f61c593638"
                }
            }
        }
    ]
}

[MIchaelMainer]

Interesting find that Shared with me only works for files shared within an organization. Your guess is as good as mine. It appears to be a limitation whether it is intentional or not.

[ElisaKazan]

Can you let me know if it's intentional? It would be really nice to be able to get this data 😃

[MIchaelMainer]

I don't know whether it is intentional. I suggest two actions to get an answer for this: 1) open an issue against the documentation for sharedWithMe about whether this API only applies to in org shared files and if so, the docs should be updated, 2) open a question on stackoverflow and tag it with microsoft-graph.

With that all said, I think it makes sense for this to be intentional, especially from an admin account. As a bad external actor just needs an admin's email address to surface a shared file with malicious code in the admin's SharePoint experience.