I am calling /drives/<drive-id>/items/<item-id>?expand=listItem,permissions and am only getting sharepoint groups listed in the file's permissions. There are microsoft 365 groups assigned to the sharepoint site and I have seen the corresponding 365 group listed in this very permissions list before, but it seems to have disappeared. The scope of the access token I am using is: User.ReadBasic.All+Group.Read.All+Directory.AccessAsUser.All+Files.Read+Files.Read.All+Sites.Read.All+offline_access

Hi @Anonymous , I have verified the below Microsoft Graph API end points and both returns permissions object/resource in API response. GET /drives/{drive-id}/items/{item-id}?expand=listItem,permissions GET /drives/{drive-id}/items/{item-id}/permissions However as mentioned in this permissions resource documentation, grantedTo property will return IdentitySet and the IdentitySet resource and it's supported properties are application,device and user. M365 Group is no more supported property of IdentitySet and hence you might be seeing the difference in response. Please note the below 2 important points on permissions resource type : As mentioned here , grantedTo and grantedToIdentities will be deprecated going forward and the response will be migrated to grantedToV2 and grantedToIdentitiesV2 respectively under appropriate property names. 2.As mentioned here , grantedToV2 propery will return SharePointIdentitySet resource and currently it supports siteUser (i.e,SharePoint user) and siteGroup (i.e., SharePoint group) properies. It does not support or return M365 group property. Hope this helps. If the answer is helpful, please click " Accept Answer " and kindly upvote it. If you have any further questions about this answer, please click " Comment ".

Why am I only getting sharepoint groups when requesting a DriveObject's permissions

Accepted answer

JanardhanaVedham-MSFT 3,536 Reputation points

2022-04-29T07:02:13.26+00:00
Hi @Anonymous ,

I have verified the below Microsoft Graph API end points and both returns permissions object/resource in API response.

GET /drives/{drive-id}/items/{item-id}?expand=listItem,permissions
GET /drives/{drive-id}/items/{item-id}/permissions

However as mentioned in this permissions resource documentation, grantedTo property will return IdentitySet and the IdentitySet resource and it's supported properties are application,device and user. M365 Group is no more supported property of IdentitySet and hence you might be seeing the difference in response.

Please note the below 2 important points on permissions resource type :

As mentioned here, grantedTo and grantedToIdentities will be deprecated going forward and the response will be migrated to grantedToV2 and grantedToIdentitiesV2 respectively under appropriate property names.

2.As mentioned here, grantedToV2 propery will return SharePointIdentitySet resource and currently it supports siteUser (i.e,SharePoint user) and siteGroup (i.e., SharePoint group) properies. It does not support or return M365 group property.

Hope this helps.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have any further questions about this answer, please click "Comment".
Please sign in to rate this answer.

1 person found this answer helpful.
Adam 41 Reputation points

2022-05-02T14:08:22.813+00:00

Thanks for the response. With this change, how can I get a M365 group that is assigned to a Sharepoint Site? Is there no way to do this now?

Adam 41 Reputation points

2022-05-02T14:35:39.637+00:00

I am also trying /sites/<site-id>/permissions and getting a blank array for the value.

JanardhanaVedham-MSFT 3,536 Reputation points

2022-05-03T10:53:07.017+00:00

Hi @Anonymous ,

Thanks for your reply. Please find the clarifications on your follow up questions :

As mentioned above, Drive Item List Permissions API currently returns and supports siteUser (i.e,SharePoint user) and siteGroup (i.e., SharePoint group) properties and it does not support or return M365 group property.

SharePoint List Permissions AP ( GET /sites/{sitesId}/permissions ) returns the permissions granted to an registered azure AD app on a SharePoint site. Example : App is registered in Azure AD and permissions granted to that app(s) on a given SharePoint site will be returned as part this API response.

For getting group associated to teams or SharePoint site and you try using Groups Graph API :

List Groups : GET https://graph.microsoft.com/v1.0/groups
Get Group : GET https://graph.microsoft.com/v1.0/groups/{group-id}

Hope this helps.

If the above provided answer is helpful to you, please click "Accept Answer" and kindly upvote it, so that it will also useful for other community users. If you have any further questions about this answer, please click "Comment".

Adam 41 Reputation points

2022-05-03T15:18:04.777+00:00

Thanks for the reply! My situation requires me to get the group id that is tied to a sharepoint site. Based on your last reply, it seems the only way to do that is using the /groups endpoint and then match up some string parameters with site names and group displayName/mailNickname? This doesnt seem very ideal as Im really trying to find an id to id match so theres no possibility of a mismatch. Is what I just described the only way to tie a M365 group to a sharepoint site?

Example:
/sites/<site-id>.displayName === /groups/<group-id>.displayName ?

Adam 41 Reputation points

2022-05-03T17:29:03.153+00:00

My example above also wouldnt work if multiple groups were allowed access to a sharepoint site.

JanardhanaVedham-MSFT 3,536 Reputation points

2022-05-04T07:18:07.827+00:00

Hi @Anonymous ,

Thanks for the update.

Your original question is regarding drive item permission and that has been answered. As meniotned in my above provided answer, Drive Item List Permissions API currently returns and supports siteUser (i.e,SharePoint user) and siteGroup (i.e., SharePoint group) properties and it does not support or return M365 group property.

Regarding your other question on fetching groups associated with a sharepoint site, can you please put up a new post in this Q&A community forum for better visibily and which will be reviewed by all community experts and will provide you the required clarifications. I will also do my analysis and provide you the required clarification as part of that post once it is available. Thanks for your understanding.

Since the original question on drive item permissions has been answered and if it is helpful to you, I would request you to click "Accept Answer" and kindly upvote it and If you have additional questions about the above provided answer, please click "Comment".
Sign in to comment

Why am I only getting sharepoint groups when requesting a DriveObject's permissions

0 additional answers