I am having a problem with retrieving RoleAssignments (for any object, web, list, folder etc.)

I have attempted to get it through:

1. https://[my_company].sharepoint.com/_api/Web/RoleAssignments

2. https://[my_company].sharepoint.com/_api/Web/Lists(guid'2924c92c-32db-4e55-b44f-638ca2b90f2e')/RoleAssignments

In both cases I get the following error:

{     code: "-2147024891, System.UnauthorizedAccessException"     
      message: {
        lang: "en-US"     
        value: "Access denied. You do not have permission to perform this action or access this resource."             

I am currently getting my AccessToken using the following scope permissions:

"AllSites.Manage Site.Manage Web.Manage List.Manage AllProfiles.Manage"

Which is basically everything that seems somehow relevant...

I am getting valid responses for any other REST query I try, evertyhing except permission related info. I see a lot of questions about this error in different sharepoint forums - and no answer...

The App defined in Azure has ALL of the available permissions selected, both in Application and Delegated permissions lists.

The User I am giving the consent with is assigned both:

  1. assigned as a SiteCollection Administrator
  2. member of the "Team Site Owners" group

I would like to know what are the exact permissions required to access the RoleAssignments endpoint, and hopefully understand what I'm doing wrong...

1 Answer 1


You need to make sure that you have set groups property properly.

It should be so that everyone can see people in the groups. If its hidden to only group members then it will always throw access denied!

Also, if you are calling this from workflow make sure it's in an appstep.

  • What is the "groups property" ?
    – Roman
    Nov 22, 2015 at 15:10
  • Go to a group and there would be settings tab there.
    – Taran Goel
    Nov 22, 2015 at 15:11
  • ok, I checked all relevant groups - they are all configured to allow "everyone" to list their members so it must be something else...
    – Roman
    Nov 24, 2015 at 10:03
  • you are calling it via worklfow?
    – Taran Goel
    Nov 24, 2015 at 10:42
  • No, as the title says, I am using REST API. It is called directly from my application
    – Roman
    Nov 24, 2015 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.