A customer of ours has their Sharepoint Online access permissions configured via (non-azure) security groups.
We query the roles attached to an item in Sharepoint via the Sharepoint REST API with the following request:
https://<tenant>.sharepoint.com/sites/TestSite/_api/web/RoleAssignments?$expand=Member/Users
And the response looks something like this:
{
"odata.metadata": "https://<tenant>.sharepoint.com/sites/TestSite/_api/$metadata#SP.ApiData.RoleAssignments",
"value": [
{
"odata.type": "SP.RoleAssignment",
"odata.id": "https://<tenant>.sharepoint.com/sites/TestSite/_api/Web/RoleAssignments/GetByPrincipalId(3)",
"odata.editLink": "Web/RoleAssignments/GetByPrincipalId(3)",
"[email protected]": "Web/RoleAssignments/GetByPrincipalId(3)/Member",
"Member": {
"odata.type": "SP.Group",
"odata.id": "https://<tenant>.sharepoint.com/sites/TestSite/_api/Web/RoleAssignments/GetByPrincipalId(3)/Member",
"odata.editLink": "Web/RoleAssignments/GetByPrincipalId(3)/Member",
"[email protected]": "Web/RoleAssignments/GetByPrincipalId(3)/Member/Users",
"Users": [
{
"odata.type": "SP.User",
"odata.id": "https://<tenant>.sharepoint.com/sites/TestSite/_api/Web/GetUserById(8)",
"odata.editLink": "Web/GetUserById(8)",
"Id": 8,
"IsHiddenInUI": true,
"LoginName": "c:0o.c|federateddirectoryclaimprovider|<some hexadecimal ID>_o",
"Title": "Besitzer von TestSite",
"PrincipalType": 4,
"Email": "TestSite@<tenant>.onmicrosoft.com",
"Expiration": "",
"IsEmailAuthenticationGuestUser": false,
"IsShareByEmailGuestUser": false,
"IsSiteAdmin": true,
"UserId": null,
"UserPrincipalName": null
}
],
"Id": 3,
"IsHiddenInUI": false,
"LoginName": "TestSite Owners",
"Title": "TestSite Owners",
"PrincipalType": 8,
"AllowMembersEditMembership": false,
"AllowRequestToJoinLeave": false,
"AutoAcceptRequestToJoinLeave": false,
"Description": null,
"OnlyAllowMembersViewMembership": false,
"OwnerTitle": "TestSite Owners",
"RequestToJoinLeaveEmailSetting": ""
},
"PrincipalId": 3
}
]
}
Now, according to the microsoft documentation, PrincipalType 4 means that the "user" really is a "SecurityGroup". In our test system, the security group has an Azure ID which makes it relatively easy to get information on via the Graph API. But in our customer's system the ID is some 16 digit hexadecimal string in a format that I can't find anywhere else.
How can I find the members of this "SecurityGroup" via any API?
