Limit API / Graph API access for certain user / roles in SharePoint Server On-Premise

Question

I have a security report regarding SharePoint site user enumeration, and the recommendation is to limit access to the user information list by breaking inheritance and applying strict permission. Is there any way to limit users / roles for accessing API / Graph API on SharePoint Server On-Premise?

Answer 1

Note: Microsoft is providing this information as a convenience to you. These sites are not controlled by Microsoft, and Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please ensure that you fully understand the risks before using any suggestions from the below link.

Hi Mohammad Malik Abdul Aziz

Thank you for posting your question in the Microsoft Q&A forum.

Microsoft Graph is a RESTful web API that enables you to access Microsoft Cloud service resources.

Which means Microsoft Graph does not communicate to SharePoint Server (on‑prem) directly.To restrict a user from using the SharePoint On-Premises REST API, you cannot block the REST API directly (it uses the same permissions as normal SharePoint access). Instead, you must control access by adjusting permissions or limiting endpoints.

• Like you mentioned, you can break inheritance or remove Permissions on the Site / List / Library If a user has: No access to a site → REST cannot read it, Read-only access to a list → REST can only read. To do that, go to Site Settings > Site Permissions > Remove user/group or change them to read-only. If needed, break inheritance on specific lists/libraries and remove permissions there
• Create a custom permission level without “Use Remote Interfaces” permission. This permission allows REST/SOAP/Client Object Model calls. access - Permissions check box "Use Remote Interfaces" when unchecked prevents users from…
• If you want to block it fully, in IIS: Select the SharePoint web application > Go to Request Filtering Block URLs containing: _api/ _vti_bin/client.svc or use IP Restrictions to block users from certain IP ranges. Please note it will affect all users.

Please try and let me know if it works for you.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

To limit API or Graph API access for certain users or roles in SharePoint Server On-Premise, you can utilize permission levels and inheritance settings. Here are some steps you can take:

1. Break Inheritance: You can break permission inheritance on the User Information List or any other list/library where you want to restrict access. This allows you to set unique permissions for that specific list.
2. Set Unique Permissions: After breaking inheritance, you can define specific permissions for users or groups. You can assign them to roles that have limited access, ensuring that only authorized users can access the API.
3. Use Limited Access: SharePoint has a Limited Access permission level, which allows users to access specific resources without granting them full access to the site. This can be useful for scenarios where you want to allow access to certain lists or libraries while restricting overall site access.
4. Fine-Grained Permissions: You can create custom permission levels that include only the necessary permissions for specific roles or users. This helps in minimizing the risk of user enumeration by restricting access to sensitive information.
5. PowerShell Cmdlets: Use PowerShell cmdlets to manage permissions programmatically. For example, you can use the Add-SPShellAdmin cmdlet to grant specific permissions to users or groups.

By implementing these strategies, you can effectively limit API access and enhance security in your SharePoint environment.

---

References:

• Best practices for using fine-grained permissions in SharePoint Server
• On-premises SharePoint Server user permissions and permission levels

Answer 3

Hi @Jayden-P

Thank you for your response. I have tried creating a custom permission level without the “Use Remote Interfaces” option. Users now do not have access to the site, but why can users still access the _api/? endpoint?