I am using Microsoft Graph API to download a file from OneDrive and have set up the following permissions:

• Files.Read.All (Application) – Read files in all site collections
• User.Read.All (Application) – Read all users’ full profiles

These permissions allow me to access the data for all users and their sites using the respective endpoints. However, I only want to access the OneDrive files of a specific user using application permissions. I do not want to use delegate permissions.

Here is what I have tried so far:

1. Accessing OneDrive Files with Application Permissions:

   GET https://graph.microsoft.com/v1.0/users/{userId}/drive/root/children
   

   This works but gives me access to all users’ data, which I don’t want.

2. Limiting Scope to Specific User:
   I attempted to find a way to limit the scope of the application permissions to a single user but couldn’t find a straightforward method in the Microsoft Graph documentation.

Questions:

1. Is there a way to configure the application permissions so that they are restricted to only one specific user’s OneDrive files?
2. If not, what are the best practices to achieve this goal without switching to delegate permissions?

Environment:

• Microsoft Graph API
• OneDrive for Business
• Application Permissions (not Delegate Permissions)

Any guidance or examples would be greatly appreciated!