We are trying to run a REST call to get RoleAssignments for a SharePoint online site. The error I am getting is "attempted to perform and unauthorized operation". This seems like a permissions issue but I am not sure what permissions are needed or where to assign them? This is essentially what I am trying to use: https:('sitecollection')/sites/'name'/_api/Web/lists/getByTitle('mytitle')/roleassignments?$expand=Member/Users.RoleDefinitionBindings

Hi @svbianca5280 , To retrieve permissions for sharepoint site, you need to have full control permissions on this site. Ask your site collection administrators to give your full control permissions. The permission page url is : /_layouts/15/user.aspx If an Answer is helpful, please click " Accept Answer " and upvote it. Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Error "attempted to perform an unauthorized operation" when attempting to run a RoleAssignments request with REST API

Accepted answer

MichaelHan-MSFT 18,046 Reputation points

2021-08-11T01:44:38.517+00:00

Hi @svbianca5280 ,

To retrieve permissions for sharepoint site, you need to have full control permissions on this site. Ask your site collection administrators to give your full control permissions.

The permission page url is : /_layouts/15/user.aspx

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
MichaelHan-MSFT 18,046 Reputation points

2021-08-16T06:26:22.143+00:00

@svbianca5280 ,
Is there any update on your issue?
I am willing to hear from you.

svbianca5280 21 Reputation points

2021-08-17T19:36:25.163+00:00

The accounts we are using to run this have full permissions to the SharePoint online site and are still getting the same error: ""Attempted to perform an unauthorized operation."

IThen, I found out that our dev team was actually trying to run this from an application. I granted the application API permissions for SharePoint Online in Azure AD. I had to grant it full control to all sites. Is there anyway to only grant it full control to specific sites? ![123979-image.png][1]

MichaelHan-MSFT 18,046 Reputation points

2021-08-18T06:57:38.73+00:00

@svbianca5280 ,
No. For AAD APP, by default we can only grant sharepoint permissions on all sites. From the screenshot, looks you are granting delegated permission for AAD APP.

For delegated permissions, the effective permissions of your app are the intersection of the delegated permissions the app has been granted (via consent) and the privileges of the currently signed-in user. Your app can never have more privileges than the signed-in user.

svbianca5280 21 Reputation points

2021-08-18T14:42:45.117+00:00

Thank you for the clarification!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Error "attempted to perform an unauthorized operation" when attempting to run a RoleAssignments request with REST API

0 additional answers

Your answer