I am having a problem with retrieving RoleAssignments (for any object, web, list, folder etc.)

I have attempted to get it through:

1. https://[my_company].sharepoint.com/_api/Web/RoleAssignments

2. https://[my_company].sharepoint.com/_api/Web/Lists(guid'2924c92c-32db-4e55-b44f-638ca2b90f2e')/RoleAssignments

In both cases I get the following error:

{     code: "-2147024891, System.UnauthorizedAccessException"     
      message: {
        lang: "en-US"     
        value: "Access denied. You do not have permission to perform this action or access this resource."             

I am currently getting my AccessToken using the following scope permissions:

"AllSites.Manage Site.Manage Web.Manage List.Manage AllProfiles.Manage"

Which is basically everything that seems somehow relevant...

I am getting valid responses for any other REST query I try, evertyhing except permission related info. I see a lot of questions about this error in different sharepoint forums - and no answer...

The App defined in Azure has ALL of the available permissions selected, both in Application and Delegated permissions lists.

The User I am giving the consent with is assigned both:

  1. assigned as a SiteCollection Administrator
  2. member of the "Team Site Owners" group

I would like to know what are the exact permissions required to access the RoleAssignments endpoint, and hopefully understand what I'm doing wrong...


You need to make sure that you have set groups property properly.

It should be so that everyone can see people in the groups. If its hidden to only group members then it will always throw access denied!

Also, if you are calling this from workflow make sure it's in an appstep.

  • What is the "groups property" ? – Roman Nov 22 '15 at 15:10
  • Go to a group and there would be settings tab there. – Taran Goel Nov 22 '15 at 15:11
  • ok, I checked all relevant groups - they are all configured to allow "everyone" to list their members so it must be something else... – Roman Nov 24 '15 at 10:03
  • you are calling it via worklfow? – Taran Goel Nov 24 '15 at 10:42
  • No, as the title says, I am using REST API. It is called directly from my application – Roman Nov 24 '15 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.