Microsoft Graph API for drive Item permissions

Question

Hello,

I am using Microsoft Graph API v1.

The setup of my app application:

1. My users are assigned to Groups that have different permissions(owner and restricted read).
2. The Groups are assigned to the site.
3. I need to check the permissions of a particular user to a particular drive item(file) via Microsoft Graph API.

I am using the following option for the permissions:

groups/${groupId}/drive/items/${documentId}?$select=id&$expand=permissions

I get the following result for uses in the "Member" group with restricted read access:

{
  "@odata.context": "@odata.context",
  "@odata.etag": "@odata.etag",
  "id": "id",
  "permissions@odata.navigationLink": "drive/items/id/permissions",
  "permissions": [
    {
      "grantedTo": {
        "user": {
          "displayName": "Owner"
        }
      },
      "id": "id",
      "roles": []
    },
    {
      "grantedTo": {
        "user": {
          "email": "",
          "id": "",
          "displayName": "Member"
        }
      },
      "id": "id",
      "roles": []
    }
  ]
}

When I change the permission of the "Member" group to "read" access, I get the following result:

{
  "@odata.context": "@odata.context",
  "@odata.etag": "@odata.etag",
  "id": "id",
  "permissions@odata.navigationLink": "drive/items/id/permissions",
  "permissions": [
    {
      "grantedTo": {
        "user": {
          "displayName": "Owner"
        }
      },
      "id": "id",
      "roles": []
    },
    {
      "grantedTo": {
        "user": {
          "email": "",
          "id": "",
          "displayName": "Member"
        }
      },
      "id": "id",
      "roles": []
    }
  ]
}

When I change the permission of the "Member" group to "edit" access, I get the following result:

{
  "@odata.context": "@odata.context",
  "@odata.etag": "@odata.etag",
  "id": "id",
  "permissions@odata.navigationLink": "drive/items/id/permissions",
  "permissions": [
    {
      "grantedTo": {
        "user": {
          "displayName": "Owner"
        }
      },
      "id": "id",
      "roles": ["owner"]
    },
    {
      "grantedTo": {
        "user": {
          "email": "",
          "id": "",
          "displayName": "Member"
        }
      },
      "id": "id",
      "roles": ["write"]
    }
  ]
}

I have also tried this endpoint:

groups/${groupId}/drive/items/${documentId}/permissions

It shows the same results: "owner"/"write" roles when a user has a "write" role and an empty string when a user has a read or restricted role.

Could you please advise me on how to get detailed information on what permission the user has?

Answer 1

Currently using Graph API you can use List drive item permissions or List sites permissions.

GET /sites/{siteId}/drive/items/{itemId}/permissions  
GET https://graph.microsoft.com/v1.0/sites/{sitesId}/permissions  

To Get permission for SharePoint user is not yet supported. Since this feature/functionality is presently not available, you can upvote this feature request idea using this support link, which will be monitored by Microsoft team and make the enhancements to Microsoft Graph APIs.

As a workaround, I would recommend you to use following rest api to get the permission

https://SomeSharepoint.sharepoint.com/sites/test2/_api/web/GetFileByServerRelativeUrl('/sites/test2/SitePages/test1.aspx')?$expand=ListItemAllFields/RoleAssignments/Member,ListItemAllFields/RoleAssignments/RoleDefinitionBindings,ListItemAllFields/RoleAssignments/Member/Users

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.