sharedWithMe returns only one item

You’re not missing something obvious in terms of auth flow — your reasoning about delegated auth and /me is correct. The missing piece is pagination, combined with a subtle Graph Explorer behavior.

/me/drive/sharedWithMe is a paged endpoint.

In your application response, you only see the first page, which in your case happens to contain one item.

In Graph Explorer, you see all items because:

• Graph Explorer automatically follows @odata.nextLink
• Your app does not, so it stops after the first page

This is why:

• Same user
• Same endpoint
• Same permissions
• Different results

Why you didn’t notice pagination

Your app response:

{

  "@odata.context": "...",

  "value": [

    { ... one item ... }

  ]

}

But Graph will only include @odata.nextLink when there is another page. Many SDKs and tools (including Graph Explorer) fetch it automatically, but raw HTTP clients do not.

If you inspect the raw HTTP response headers or enable tracing, you should see something like:

"@odata.nextLink": "https://graph.microsoft.com/v1.0/me/drive/sharedWithMe?$skiptoken=..."

Your app needs to explicitly follow that link.

Why Graph Explorer looks “complete”

Graph Explorer:

• Uses delegated auth
• Uses /me
• Automatically:
• Detects @odata.nextLink
• Fetches subsequent pages
• Merges results into one array

So it appears like a single response.

How to fix it in your app

Option 1: Follow @odata.nextLink (recommended)

Pseudo-logic:

GET /me/drive/sharedWithMe

while (@odata.nextLink exists):

    GET @odata.nextLink

    append items

Option 2: Increase page size

You can request more items per page:

GET /me/drive/sharedWithMe?$top=50

This reduces paging but does not eliminate it — you still must handle @odata.nextLink.

Important clarifications (to rule out other theories)

You are using delegated auth
/me/drive/sharedWithMe is correct
OAuth2 authorization code flow is correct
This is not an application-permissions limitation
This is not a OneDrive personal vs business issue
This is not a permissions scope issue

Final takeaway

The endpoint is working correctly.
Your app is only processing the first page of results.

Once you implement pagination handling, your standalone app will return the same items as Graph Explorer.