Remove Specific Users from Sharing Permission

Question

According to this documentation: https://learn.microsoft.com/en-us/graph/api/permission-grant?view=graph-rest-1.0&tabs=http, we can add users to sharing permissions using their email IDs. However, I couldn't find a method to remove specific users from these permissions. The documentation only shows how to either completely remove a permission or update roles for an entire group.

My questions: Is there a way to remove specific users individually instead of all users from these sharing permissions? If not, can we create unique permission IDs for different users based on their emails (assuming we grant the same permission on the same file)?

Appreciate for the helps!

Answer 1

The Microsoft Graph API provides ways to manage permissions for resources such as files or folders, but it does have some limitations depending on the context of permissions:

1. Removing Specific Users: Unfortunately, the Graph API doesn't directly support removing individual users from a permission grant. The API typically revolves around managing permissions at the scope of the permission grant itself, which means you can update or delete the entire permission grant but not remove specific users from it directly.
2. Unique Permission IDs: Each permission grant in Microsoft Graph API is associated with a unique id. If you grant permissions to different users on the same file, each permission grant will have its own unique id. This means that you can manage and manipulate these permissions individually through their respective id, but again, you can't modify the list of users directly within a grant once it's created.

To handle scenarios where you might need to remove specific users while keeping others intact, you typically have to manage this logic outside of the Graph API by tracking which users are associated with which permissions. You can then either delete the entire permission grant and recreate it with the desired users or use more granular controls within your application logic.

If you need to achieve finer-grained control over individual user permissions, you might need to reconsider the permission structure or implement additional logic on top of the basic Graph API operations to achieve your specific requirements.