Remove-MgDriveRootPermission accepts the command but does not remove the permission

Jesus Chao 141

Hi, I posted this on GitHub and have not received any feedback so I thought I would try here.
I was asked to create an automation that would remove any admin accounts that were given permission to a user's onedrive on a daily basis. We are using Azure Automation to accomplish this. When using the cmdlet get-mgdriverootpermission, we are able to see the permissions that have been applied to a user's OneDrive. We then use the following to remove the permission: Remove-MgDriveRootPermission -driveid $userdrive.id -permissionid $permission.id The $userdrive variable is the drive ID found when using get-mguserdrive.
The $permission.id is the ID of the permission found when using get-mgdriverootpermission. The cmd completes with no errors however when we look at the permissions, the permission still exists....

I tested this with the latest 2.1.0 version of the Graph cmdlets and also tested this directly on the Graph API itself. Same result. Here is the uri: https://graph.microsoft.com/v1.0/drives/{driveid}/items/root/permissions/{permissionid} The result has an interesting response in the raw content: Deprecation: Fri, 03 Sep 2021 23:59:59 GMT
Sunset: Sun, 01 Oct 2023 23:59:59 GMT

1 answer

Sourabh Gupta 800 Reputation points Microsoft Vendor

2024-02-10T14:26:42.0933333+00:00

Hi Jesus Chao, Thanks for reaching out. Based upon the document below. Could you please check the inheritedFrom property of the permission you are deleting. Only sharing permissions that are not inherited can be deleted. The inheritedFrom property must be null https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.files/remove-mgdriverootpermission?view=graph-powershell-1.0 However, the document mentions this command Remove access to a DriveItem which is misleading based upon the name of the command itself. If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Please sign in to rate this answer.
Jesus Chao 141 Reputation points

2024-02-12T18:01:15.15+00:00

There is data and it is not null but I am not sure what the data is or how to get it. The cmdlet is "get-mgdriverootpermission" which I would assume ROOT would be the highest level and there would be no inheritance. How and where does the inheritance come from. When I try to expand the property, there is nothing there but I suspect that is because the data is at another level?

Sourabh Gupta 800 Reputation points Microsoft Vendor

2024-02-17T12:51:57.8266667+00:00

Hi Jesus Chao, May be you can go to graph explorer and run the following query. Graph explorer can be accessed at the link https://developer.microsoft.com/en-us/graph/graph-explorer Query to Run : https://graph.microsoft.com/v1.0/users/{user-id}/drive/root/permissions once you will run this query copy the permission id from the response as shown in the screenshot

https://graph.microsoft.com/v1.0/users/{user-id}/drive/root/permissions/{permission-id} and replace the permission if in the following query to get the inheritedfrom property. Kindly let me know if any more help is required

Jesus Chao 141 Reputation points

2024-02-22T16:36:38.6433333+00:00

I don't have permissions to use Graph Explorer. However, if I use a simple invoke-webrequest, there is NO PROPERTY of InhertedBy in the results. Are you sure that property exists or am I missing permissions?

Jesus Chao 141 Reputation points

2024-02-22T16:38:28.93+00:00

Deleted Post

Sourabh Gupta 800 Reputation points Microsoft Vendor

2024-02-25T13:10:12.77+00:00

Hi Jesus Chao, The resolution of the image is quite low, I am not able to clearly see the resposnse. for accessing graph explorer you can go to following link https://developer.microsoft.com/en-us/graph/graph-explorer its accessible to everyone untill its blocked for you by your admin

Sourabh Gupta 800 Reputation points Microsoft Vendor

2024-02-25T13:11:50.8133333+00:00

Hi Jesus Chao The resolution of the image is quite low to look into the response. Please upload a new one. Graph explorer can be accessed at following link https://developer.microsoft.com/en-us/graph/graph-explorer

Jesus Chao 141 Reputation points

2024-02-26T15:44:26.2533333+00:00

Yes I can access Graph Explorer but as you know - you have to have specific Graph Explorer app permissions to Files.Read.All and Sites.Read.All to view these specific Graph areas which I do not have in the Graph Explorer enterprise app.
Can you not right click on the image in Edge and select Edit Image - that will allow you to zoom in.

Sourabh Gupta 800 Reputation points Microsoft Vendor

2024-02-26T16:02:20.7033333+00:00

Hi Jesus Chao , If the inheritedFrom property is not returned in that case the value is null. I guess Permission should not be an issue to see inheritedFrom property

Sourabh Gupta 800 Reputation points Microsoft Vendor

2024-02-26T16:04:17.7366667+00:00

Hi Jesus Chao, I think permission should not be an issue to see inheritedFrom property. I think the value is null for this particular drive.

Jesus Chao 141 Reputation points

2024-02-26T16:49:04.0133333+00:00

Great - if its null then what?

Sourabh Gupta 800 Reputation points Microsoft Vendor

2024-03-02T08:50:45.8366667+00:00

if this property is null then. The permission is not inherited.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Remove-MgDriveRootPermission accepts the command but does not remove the permission

1 answer

Your answer