ExternalItem.Read.All | Graph Permissions

Permission Details

Application Permission

Read all external items

Allows the app to read all external items without a signed-in user.

Permission ID: 7a7cffad-37d2-4f48-afa4-c6ab129adcc2

Delegated Permission

Read items in external datasets

Allow the app to read external datasets and content, on behalf of the signed-in user.

Permission ID: 922f9392-b1b7-483c-a4be-0089be7704fb

Properties

Microsoft Graph beta exact-category

Properties is shown from beta metadata because a stable v1.0 schema is not available for this resource mapping.

Property	Type	Description
`acl`	`acl collection`
`content`	`object`
`id`	`string`	The unique identifier for an entity. Read-only.
`informationProtectionLabel`	`object`
`properties`	`object`

JSON Representation

Microsoft Graph beta exact-category

JSON representation is shown from beta metadata because a stable v1.0 schema is not available for this resource mapping.

JSON representation

{
  "acl": [
    {
      "@type": "acl",
      "id": "00000000-0000-0000-0000-000000000000"
    }
  ],
  "content": {
    "sample": "value"
  },
  "id": "String",
  "informationProtectionLabel": {
    "sample": "value"
  },
  "properties": {
    "sample": "value"
  }
}

Relationships

Microsoft Graph beta schema-derived

Relationships is shown from beta metadata because a stable v1.0 schema is not available for this resource mapping.

Relationship	Type	Description
`acl`	`acl collection`	Related acl data exposed by this resource.

Graph Methods

Delegated access App-only access

Exact Microsoft Learn match

Microsoft Graph v1.0 endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET `/external/connections/{connectionsId}/groups/{externalGroupId}`
GET `/external/connections/{connectionsId}/items/{externalItemId}`
POST `/search/query`

Exact Microsoft Learn match

Microsoft Graph beta endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET `/external/connections/{connection-id}/items/{item-id}`
POST `/search/query`

Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell v1.0 commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
`Get-MgExternalConnectionGroup` /external/connections/{connectionsId}/groups/{externalGroupId} Get externalGroup
`Get-MgExternalConnectionItem` /external/connections/{connectionsId}/items/{externalItemId} Get externalItem
`Invoke-MgQuerySearch` /search/query searchEntity: query

Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell beta commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
`Get-MgBetaExternalConnectionItem` /external/connections/{connection-id}/items/{item-id} Get externalItem
`Invoke-MgBetaQuerySearch` /search/query searchEntity: query

Code Examples

C# / .NET SDK

Get externalGroup

View official example on Microsoft Learn

// Code snippets are only available for the latest version. Current version is 5.x

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.External.Connections["{externalConnection-id}"].Groups["{externalGroup-id}"].GetAsync();

JavaScript

Get externalGroup

View official example on Microsoft Learn

const options = {
	authProvider,
};

const client = Client.init(options);

let externalGroup = await client.api('/external/connections/contosohr/groups/31bea3d537902000')
	.get();

PowerShell

Get externalGroup

View official example on Microsoft Learn

Import-Module Microsoft.Graph.Search

Get-MgExternalConnectionGroup -ExternalConnectionId $externalConnectionId -ExternalGroupId $externalGroupId

Python

Get externalGroup

View official example on Microsoft Learn

# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python

result = await graph_client.external.connections.by_external_connection_id('externalConnection-id').groups.by_external_group_id('externalGroup-id').get()

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Application permissions or delegated permissions and search for ExternalItem.Read.All

4

Grant Admin Consent

Application permissions always require admin consent.

Frequently asked questions

What is the ExternalItem.Read.All Microsoft Graph permission?

ExternalItem.Read.All is available as both an application permission and a delegated permission in the Microsoft Graph API, grouped under the ExternalItem category. Allows the app to read all external items without a signed-in user. It grants read-only access to resources. Application permissions always require admin consent. It is mapped to the Microsoft Graph externalItem resource type. 5 documented Microsoft Graph REST methods require it. 5 Microsoft Graph PowerShell commands are documented for it.

Is ExternalItem.Read.All an application or a delegated permission?

ExternalItem.Read.All is available as both an application permission (app-only access, no signed-in user) and a delegated permission (access on behalf of a signed-in user).

Does ExternalItem.Read.All require admin consent?

Application permissions always require admin consent.

What is the permission ID (GUID) for ExternalItem.Read.All?

For ExternalItem.Read.All, the application (app role) ID is 7a7cffad-37d2-4f48-afa4-c6ab129adcc2, and the delegated (OAuth2 scope) ID is 922f9392-b1b7-483c-a4be-0089be7704fb. These are the real Microsoft Graph identifiers and can be used directly in an app registration manifest.