Get Sharepoint library permissions

Rick Doll 21

I am looking to see how I can get a list of all users, and groups, and users within groups, that have permissions to Libraries within Sharepoint.

I am trying to use MS Graph, but I am open to using the graph or the sharepoint rest api.

Any help would be appreciated!

Rick Doll 21 Reputation points

2022-05-12T22:28:40.773+00:00

Apparently the library I am trying to get these permissions for are in a "Web".

I have tried to use graph to find this "web", which I had thought was like a subsite, but have no idea how to find this in graph.

I can get to the "web" in the sharepoint rest api, and I can iterate through the library, but cannot seem to get all the users and groups that have permissions for said library.

My preference is the graph as I am moving pretty much anything I have that is connected to azure through graph, but at this point, either approach is fine.

Accepted answer

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
2 deleted comments

Comments have been turned off. Learn more

3 additional answers

Srinivasa Rao Darna 6,741 Reputation points Microsoft Vendor

2022-05-13T14:37:40.15+00:00
Hi @Rick Doll ,

Currently using Graph API, you can either get site permission and get drive item permissions, fetching permissions for list or library is not supported. You can upvote this feature request for list permissions user voice.

You can get subsite using GET /sites/domain.sharepoint.com:/{sitecoll}/{subsite}
Get all lists from a subsite GET /sites/domain.sharepoint.com:/{sitecoll}/{subsite}:/lists,
Drives GET /sites/domain.sharepoint.com:/{sitecoll}/{subsite}:/drives

Using SharePoint REST APIs you can get permissions for a site, list, library, item as well.

https://domain.sharepoint.com/sites/{sitecoll}/{subsite}/_api/web/lists/GetByTitle('{listTitle}')/RoleAssignments?$expand=Member

Refrences:

Graph Site Id

SharePoint REST

Hope this helps.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have further questions about this answer, please click "Comment".
Please sign in to rate this answer.
David GROSPELIER 26 Reputation points

2022-05-16T16:29:12.247+00:00

Hi,
On my side, when using the Graph API, I got a HTTP 400 error with this message:
{
"error": {
"code": "notSupported",
"message": "Operation not supported",
"innerError": {
"date": "2022-05-16T16:28:16",
"request-id": "c5121712-c485-4176-a827-8481a454c9ba",
"client-request-id": "e5f42bb8-5c4c-3329-fce4-0e77a9637233"
}
}
}

It was working a few days ago and now it is not working anymore...
Any changes on the Graph API side?

Srinivasa Rao Darna 6,741 Reputation points Microsoft Vendor

2022-05-16T17:16:05.29+00:00

Hi @David GROSPELIER ,

Can you share the Graph API which you are using.

In view of PII, We are unable to check logs based on request-id on community forums. Please raise a support case with Microsoft Graph from the tenant where the issue is happening, a specialized Support Engineer will be able to assist you better.

You can raise technical support request from https://aad.portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/overview or https://admin.microsoft.com/#/support/requests

Hope this helps.

Adrian Corral Ruiz 20 Reputation points

2024-09-27T12:14:16.5966667+00:00

Hi @Srinivasa Rao Darna ,

Thank you for explaining all these options available.

I tried to get the permissions of one of my sites in my dev tenant, but I'm getting an empty array. I'll explain what I configured:

Azure App Registration with Graph -> Sites.FullControl.All api permission granted with admin consent. I have a secret created too.

Then I made a POST request to get the Bearer token to get next steps

Later, I made a GET request to get a list of sites in my tenant and worked successfully

Finally, I'm trying requesting the permissions, but an empty array is returned:

I tried to put only the id, the entire id, and more combinations, but this output is the same.

Thank you in advance for your help!

Adrián Corral Ruiz
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
David GROSPELIER 26 Reputation points

2022-05-16T18:25:03.667+00:00

We are using this API :
https://graph.microsoft.com/v1.0/sites/<host>.sharepoint.com,<siteid>/lists/<listid>/items?expand=fields(select=id,Title)&select=id&$filter=fields/Modified ge '2022-04-15T09:29:37.3541196Z' (this operation in the doc: listitem-list).

But we also tried to call this API https://graph.microsoft.com/v1.0/sites/<host>.sharepoint.com,<siteid>/permissions and we have an error telling that the operation is not supported... But it was working in the past (this operation in the doc: site-list-permissions).
Please sign in to rate this answer.
Srinivasa Rao Darna 6,741 Reputation points Microsoft Vendor

2022-05-18T15:59:57.557+00:00

@David GROSPELIER , This is supported only by application permission scope, hope you are using application permission not delegated scope.

https://learn.microsoft.com/en-us/graph/api/site-list-permissions?view=graph-rest-1.0&tabs=http
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
David GROSPELIER 26 Reputation points

2022-05-19T06:18:20.883+00:00

In fact, the API call was the right one, but there was an error in the Graph API after a recent deployment made by Microsoft, as explained in this post: the-34sitesselected34-permission-is-not-working-an.html
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Get Sharepoint library permissions

3 additional answers

Your answer