Microsoft Graph /content returns non-preauthenticated SharePoint URL which results in 401

I'm seeing behavior that appears inconsistent with the Microsoft Graph documentation for downloading driveItem content.

Expected behavior

According to the documentation, calling:

GET /drives/{drive-id}/items/{item-id}/content

should return a 302 Found redirect to a preauthenticated download URL, equivalent to @microsoft.graph.downloadUrl, which can be downloaded without additional authentication.

Observed behavior

1. Retrieve driveItem metadata:

GET /drives/{drive-id}/items/{item-id}

Response contains:

"@microsoft.graph.downloadUrl": "https://<tenant>.sharepoint.com/sites/<site>/_layouts/15/download.aspx?UniqueId=<guid>&Translate=false&ApiVersion=2.0"

1. Download content:

GET /drives/{drive-id}/items/{item-id}/content

Response:

302 Found
Location:
https://<tenant>.sharepoint.com/sites/<site>/_layouts/15/download.aspx?UniqueId=<guid>&Translate=false&ApiVersion=2.0

1. Access the returned URL:

401 Unauthorized

The URL from @microsoft.graph.downloadUrl and the Location header are identical, but the URL is not directly downloadable and requires authentication.

Questions

1. Is this behavior expected?
2. Has the behavior of @microsoft.graph.downloadUrl or /content recently changed? (The failure starting mid-Sep.)
3. Does Microsoft Graph still guarantee that @microsoft.graph.downloadUrl is a preauthenticated download URL?
4. If preauthenticated download URLs are being deprecated, what is the recommended replacement for daemon/background applications downloading files from SharePoint Online?

Additional notes

• File metadata retrieval succeeds.
• /content returns 302 successfully.
• Only the final download URL returns 401.
• SharePoint tenant administrators confirmed no recent SharePoint configuration changes.
• We were informed that the historical tempauth mechanism may be deprecated, but it is unclear whether that is related to this behavior.

Any clarification would be appreciated.