Cannot list team members

Question

When I try to list team members through the /groups/{id}/members endpoint with access_token which has User.ReadBasic.All delegated permission, as documented on https://learn.microsoft.com/en-us/graph/api/group-list-members?view=graph-rest-1.0&tabs=http I get 403 error "Insufficient privileges to complete the operation."

Is the "User.ReadBasic.All" permission sufficient to access this API?
If not, is there any other way to list team members without "Admin Consent Required" type of permission.

Answer 1

The documentation for the API is inaccurate--we'll fix that as soon as possible. Thanks for bringing this up!

The minimum permission required to list group members is GroupMember.Read.All, and this permission required admin consent. (Note: If your scenario is specifically for groups which are also teams, the permission TeamMember.Read.All might be sufficient, but it still requires admin consent by default, and you'd need to use the API to list team members.)

So the answer is no, there is no way to list team members for all teams or groups, which does not require admin consent by default.

GroupMember.Read.All allows listing all groups' membership, and allows reading the basic properties of all groups. It does not allow reading the properties of a group's member objects, unless the member object happens to be another group.

Suppose we had a group with three member objects: a user "Alice", another group "G2", and a service principal "App A".

With an app which has only been granted GroupMember.Read.All, you would see this:

   GET https://graph.microsoft.com/v1.0/groups/{id}/members?$select=id,displayName  


   {  
     "@odata.context": "https://graph.microsoft.com/beta/$metadata#directoryObjects(id,displayName)",  
     "value": [  
       {  
         "@odata.type": "#microsoft.graph.user",  
         "id": "8401fd0e-d9d9-4b02-8019-55f0c9707097",  
         "displayName": null  
       },  
       {  
         "@odata.type": "#microsoft.graph.servicePrincipal",  
         "id": "5a721aec-a180-45f1-8514-bbe7f5073111",  
         "displayName": null  
       },  
       {  
         "@odata.type": "#microsoft.graph.group",  
         "id": "93809827-fbaa-4de3-9670-1df2c7b6d7cc",  
         "displayName": "G2"  
       }  
     ]  
   }  

Note that for the user and the service principal, you get the id, but the displayName is null.

If the app had both GroupMember.Read.All and User.ReadBasic.All, here's what you'd see:

   {  
     "@odata.context": "https://graph.microsoft.com/beta/$metadata#directoryObjects(id,displayName)",  
     "value": [  
       {  
         "@odata.type": "#microsoft.graph.user",  
         "id": "8401fd0e-d9d9-4b02-8019-55f0c9707097",  
         "displayName": "Alice"  
       },  
       {  
         "@odata.type": "#microsoft.graph.servicePrincipal",  
         "id": "5a721aec-a180-45f1-8514-bbe7f5073111",  
         "displayName": null  
       },  
       {  
         "@odata.type": "#microsoft.graph.group",  
         "id": "93809827-fbaa-4de3-9670-1df2c7b6d7cc",  
         "displayName": "G2"  
       }  
     ]  
   }  

Notice that now you see the display names for both the user and the group, but you still don't see the display name for the service principal.

Finally, if the app had GroupMember.Read.All and User.ReadBasic.All and Application.Read.All (the last one is the minimum permission to read service principals), now you'd get the following:

   {  
     "@odata.context": "https://graph.microsoft.com/beta/$metadata#directoryObjects(id,displayName)",  
     "value": [  
       {  
         "@odata.type": "#microsoft.graph.user",  
         "id": "8401fd0e-d9d9-4b02-8019-55f0c9707097",  
         "displayName": "Alice"  
       },  
       {  
         "@odata.type": "#microsoft.graph.servicePrincipal",  
         "id": "5a721aec-a180-45f1-8514-bbe7f5073111",  
         "displayName": "App A"  
       },  
       {  
         "@odata.type": "#microsoft.graph.group",  
         "id": "93809827-fbaa-4de3-9670-1df2c7b6d7cc",  
         "displayName": "G2"  
       }  
     ]  
   }  

Notice that now you can read the display name of all three member objects.