How can I parse email addresses from Sharepoint DriveItem permissions?

Question

So I've been trying to get email addresses of people that have access to certain files in a Sharepoint document library of a site through the use of the Microsoft Graph API. Below is an example of how my permission object looks like, which is retrieved from https://graph.microsoft.com/v1.0/sites//drives//items//permissions.

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#sites('...')/drives('...')/items('...')/permissions",
    "value": [
        {
            "id": "...",
            "roles": ["owner"],
            "grantedTo": { "user": { "displayName": "testsite - Eigenaars" } },
            "inheritedFrom": {}
        },
        {
            "id": "...",
            "roles": ["read"],
            "grantedTo": { "user": {"displayName": "testsite - Bezoekers"} },
            "inheritedFrom": {}
        },
        {
            "id": "...",
            "roles": ["write"],
            "grantedTo": { "user": { "displayName": "testsite - Leden" } },
            "inheritedFrom": {}
        },
        {
            "id": "...",
            "roles": [
                "write"
            ],
            "grantedToV2": {
                "siteGroup": {
                    "displayName": "Developers",
                    "id": "120",
                    "loginName": "Developers"
                }
            },
            "grantedTo": {
                "user": {
                    "displayName": "Developers"
                }
            },
            "inheritedFrom": {}
        },
        {
            "id": "...",
            "roles": ["owner"],
            "grantedTo": {
                "user": {
                    "email": "testsite@mysharepoint",
                    "id": "uuid",
                    "displayName": "testsite - Eigenaars"
                }
            },
            "inheritedFrom": {}
        }
    ]
}

I assume the testsite in the displayName property is a group name (probably the group that belongs to the site the file resides in), but I have seen cases where I can't find this group name in the groups retrieved from the /groups endpoint in the Graph API.

You can also see the group Developers, which I haven't managed to find in the full group list retrieved from /groups.

The documentation around this is quite vague and unclear to me. Somewhere I read that this lack of data could be due to authentication scopes, but I have "god mode" administrator rights in this Sharepoint environment, so that would seem strange to me.

My main goal is to be able to get all users that have access to a specific file.

Thanks in advance!

user_6856820 · Answer

1. I assume the testsite in the displayName property is a group name, but I have seen cases where I can't find this group name in the groups retrieved from the /groups endpoint in the Graph API.

This is because as per Drive Item Permission >> Identity Set >> Identity resource type Quoting

The identity's display name. Note that this may not always be available or up to date. For example, if a user changes their display name, the API may show the new value in a future response, but the items associated with the user won't show up as having changed when using

This can explain why sometimes you don't see the group name in your groups. I suggest you use the id.

2. My main goal is to be able to get all users that have access to a specific file.

Do you have any users that appear on the Has Access section of the drive item on sharepoint? For users you should be able to get permissions and use the ids to Get directoryObject using the id values from grantedToIdentitiesV2 or grantedToV2 which will return odate type.

GET https://graph.microsoft.com/v1.0/directoryObjects/{id}?$select=id
{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#directoryObjects(id)/$entity",
    "@odata.type": "#microsoft.graph.group or user or application",
    "id": "id"
}

For groups, the users would be the members of the group.

How can I parse email addresses from Sharepoint DriveItem permissions?

1 Answers