title: Upload a large file into Shared Folder through Microsoft Graph API app only asp.net Access Denied
body: <p>I'm following the example of the <a href="https://github.com/microsoftgraph/aspnet-snippets-sample/blob/master/Graph-ASPNET-46-Snippets/Microsoft%20Graph%20ASPNET%20Snippets/Models/FilesService.cs" rel="nofollow noreferrer">aspnet-snippets-sample</a>
   and <a href="https://github.com/microsoftgraph/msgraph-sdk-dotnet/commit/7c037cf15413b73d1ad7b52ee027a703f4b63be1#diff-73f67618397ff61d1687ddfa1ce6ae91" rel="nofollow noreferrer">OneDriveTest.cs</a> to upload a large file through the Microsoft Graph API into a shared folder with app only credentials</p>
  
  <p>and following exception is thrown:</p>
  
  <p>"Access denied. You do not have permission to perform this action or access this resource."</p>
  
  <p>To initialize a large file upload session I do following:</p>
  
  <pre><code>var uploadSession = await _graph
                             .Drives[DRIVEID]
                             .Items[ITEMID]
                             .ItemWithPath("newFile.docx")
                             .CreateUploadSession()
                             .Request().PostAsync();
  </code></pre>
  
  <p>Both the driveId and itemId are valid.</p>
  
  <p>I'm creating my GraphClient like following:</p>
  
  <pre><code>public MicrosoftGraphHelper()
          {
  
              _graph = new GraphServiceClient("https://graph.microsoft.com/beta",
                  new DelegateAuthenticationProvider((requestMessage) =&gt;
              {
                  requestMessage.Headers.Authorization = new AuthenticationHeaderValue("bearer", AccessToken);
  
                  return Task.FromResult(0);
              }));
  
          }
  </code></pre>
  
  <p>The access token is acquired through my app credentials and secret. In Azure, my app has read/write permissions for files through Microsoft Graph.</p>
  
  <p>Also, creating a new folder like</p>
  
  <pre><code>POST https://graph.microsoft.com/beta/drives/DRIVEID/items/ITEMID/children
  </code></pre>
  
  <p>with JSON</p>
  
  <pre><code>{
    "name": "NewFolderTest",
    "folder": { }
  }
  </code></pre>
  
  <p>works as well.</p>
  
  <p>here is the Upload Task</p>
  
  <pre><code>internal async Task&lt;string&gt; UploadLargeFile(HttpPostedFileBase file)
          {
              try
              {
  
  
                  using (Stream fileStream = file.InputStream)
                  {
                      // Create the upload session. The access token is no longer required as you have session established for the upload.  
                      // POST /v1.0/drive/root:/UploadLargeFile.bmp:/microsoft.graph.createUploadSession
  
                      var driveItems = await _graph.Drives[DRIVEID]
                             .Items[ITEMID]
                             .Children
                             .Request()
                             .GetAsync();
  
                      var uploadSession = await _graph.Drives[DRIVEID]
                          .Items[ITEMID].ItemWithPath("test.docx").CreateUploadSession()
                          .Request().PostAsync();
  
                      var maxChunkSize = 320 * 1024; // 320 KB - Change this to your chunk size. 5MB is the default.
                      var provider = new ChunkedUploadProvider(uploadSession, _graph, fileStream, maxChunkSize);
  
                      // Setup the chunk request necessities
                      var chunkRequests = provider.GetUploadChunkRequests();
                      var readBuffer = new byte[maxChunkSize];
                      var trackedExceptions = new List&lt;Exception&gt;();
                      DriveItem itemResult = null;
  
                      //upload the chunks
                      foreach (var request in chunkRequests)
                      {
                          // Do your updates here: update progress bar, etc.
                          // ...
                          // Send chunk request
                          var result = await provider.GetChunkRequestResponseAsync(request, readBuffer, trackedExceptions);
  
                          if (result.UploadSucceeded)
                          {
                              itemResult = result.ItemResponse;
                          }
                      }
  
                      // Check that upload succeeded
                      if (itemResult == null)
                      {
                          // Retry the upload
                          // ...
                      }
  
                      return "Success";
                  }
  
              }
  
              catch (ServiceException e)
              {
                  // Debug.WriteLine("We could not upload the file: " + e.Error.Message);
                  return null;
              }
  
          }
  </code></pre>
  
  <p>As soon as the code hits:</p>
  
  <pre><code>var result = await provider.GetChunkRequestResponseAsync(request, readBuffer, trackedExceptions);
  </code></pre>
  
  <p>trying to request:</p>
  
  <pre><code>"https://myapp.sharepoint.com:443/sites/dev/_api/v2.0/drives/DRIVEID/items/ITEMID/uploadSession"
  </code></pre>
  
  <p>is thrown.</p>
  
  <p>What and where do I have to apply required permissions? The <a href="https://developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/api/item_createuploadsession" rel="nofollow noreferrer">Documentation</a> refers to <code>Files.ReadWrite</code> Does Sharepoint need additional permissions to Microsoft Graph API?</p>
  
  <p>Within the shared folder I can see a new created tmp file with 0 bytes.</p>