OneDrive file picker is requesting undocumented resources. How to handle these?

Question

OneDrive file picker is requesting undocumented resources. How to handle these?

Jswk1 0

Hello,

I'm working on a web application and one of the features is OneDrive integration through the Graph API and the OneDrive File Picker documented here:

https://free.blessedness.top/en-us/onedrive/developer/controls/file-pickers/?view=odsp-graph-online

It's been working fine for years, but lately I've been observing more and more errors (AADSTS65001 error code) in logs due to specific resources being requested, which require undocumented permissions.

The file picker documentation only mentions these:

User's image

However I can also see token being requested for these resources by the File Picker through the Message Listener:

The loki.delve resource is requested when an user is hovered inside the file picker. From what I was able to find on the internet, this specific resoure requires all these additional permissions:

https://github.com/maciejporebski/azure-ad-first-party-apps-permissions/blob/master/apps/Microsoft%20People%20Cards%20Service.md#application-permissions

Which seems extreme. I couldn't find the second one yet but I assume its a similar case.

Why are these resources being requested while nothing of this is mentioned in the docs? My app registration on azure does not contain permissions for these nor do I want to add these as it seems like too much for what is File Picker supposed to be doing.

2 answers

Your answer

Answer 1

Hi Jswk1

Thank you for reaching out to Microsoft Q&A forum and sharing your concern.

From your relevant documentation links and observations, I understand that you're having an issue with the OneDrive File Picker requesting tokens for undocumented resources. I truly appreciate you highlighting this issue with the OneDrive File Picker requesting tokens for undocumented resources like https://loki.delve.office.com/ and https://substrate.office.com/. You're spot on that these aren't mentioned in the official OneDrive File Picker documentation, which only covers the standard permissions.

You’re running into behavior with the OneDrive File Picker and Microsoft Graph integration, where the picker internally calls additional Microsoft 365 services. If your app does not declare these permissions in Azure AD, token acquisition for those resources fails, causing AADSTS65001. Adding these permissions would require admin consent and grant broad access (e.g., to user profiles and organizational graph), which is likely beyond your intended scope.

Importantly, please do not add these extra permissions to your Azure AD app registration. That would violate least-privilege principles and expose your app to unnecessary risks. Instead, handle them gracefully in your code.

Based on my research, I've found a similar discussion on AADSTS65001 errors in this thread: AADSTS65001: The user or administrator has not consented to use the application. You may consider referring to this thread and trying the steps outlined there such as:

Verifying admin consent in your Azure AD app registration
Ensuring the right scopes are included in your token requests
Checking your API permissions setup

Many users found the suggested steps helpful and reported that they resolved their issues. Please let me know how you get on, as your feedback is valuable to the community.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Jswk1 0

Hello,

None of the solutions in https://free.blessedness.top/en-us/answers/questions/545439/aadsts65001-the-user-or-administrator-has-not-cons?page=1#answers seem valid to me.

Why do I need to add additional permissions when official documentation don't mention them?

Just now I noticed that the search bar completely breaks the onedrive file picker for me because it requests token for https://substrate.office.com that I don't even know what is doing or what permissions does it require.

Where do I get any official information regarding these resources?

For additional clarity. I don't have substrate enabled in the authorization section of the File Picker config:

https://free.blessedness.top/en-us/onedrive/developer/controls/file-pickers/v8-schema?view=odsp-graph-online

Flora-T 5,160 Reputation points Microsoft External Staff Moderator

2025-10-16T08:21:59.7433333+00:00
Hi Jswk1

Thank you for sharing these details.

The OneDrive File Picker internally calls additional Microsoft 365 services (such as Substrate and Delve) to enable richer features like search and user profile cards. These endpoints are part of Microsoft’s first-party ecosystem and are not exposed for third-party apps, which is why they are not documented in the official File Picker guide. When your app doesn’t have permissions for these resources, token acquisition fails, resulting in AADSTS65001 errors. These calls are optional and do not affect core file selection, but they may break features like the search bar, as you observed.

Currently, Microsoft does not publish details for these internal endpoints because they are not intended for external integration. The File Picker schema only covers required scopes for OneDrive and SharePoint operations. You may need to avoid adding broad permissions for these services unless absolutely necessary and implement graceful error handling for optional features.

If you’d like to experiment with these behaviors, you may consider:

Using a virtual machine to isolate the test environment and avoid impacting your local machine.

Creating a test app registration and a test tenant to prevent exposing production data.

Please remember not to grant unnecessary permissions to personal or organizational resources and stick to least-privilege principles.

Please understand that as a forum moderator, due to testing environment limitations, I can only share insights based on Microsoft documentation and community experience.

While this Q&A forum is a valuable space for sharing insights and receiving technical guidance, the most effective way to prioritize updates and clarify these undocumented dependencies is by submitting feedback directly to Microsoft. You can do this through the Feedback Portal.

I truly appreciate your patience and feedback as we continue to improve the experience for all users.

Share via

OneDrive file picker is requesting undocumented resources. How to handle these?

2 answers

Your answer