0

A customer of ours has their Sharepoint Online access permissions configured via (non-azure) security groups.

We query the roles attached to an item in Sharepoint via the Sharepoint REST API with the following request:

https://<tenant>.sharepoint.com/sites/TestSite/_api/web/RoleAssignments?$expand=Member/Users

And the response looks something like this:

{
    "odata.metadata": "https://<tenant>.sharepoint.com/sites/TestSite/_api/$metadata#SP.ApiData.RoleAssignments",
    "value": [
        {
            "odata.type": "SP.RoleAssignment",
            "odata.id": "https://<tenant>.sharepoint.com/sites/TestSite/_api/Web/RoleAssignments/GetByPrincipalId(3)",
            "odata.editLink": "Web/RoleAssignments/GetByPrincipalId(3)",
            "Member@odata.navigationLinkUrl": "Web/RoleAssignments/GetByPrincipalId(3)/Member",
            "Member": {
                "odata.type": "SP.Group",
                "odata.id": "https://<tenant>.sharepoint.com/sites/TestSite/_api/Web/RoleAssignments/GetByPrincipalId(3)/Member",
                "odata.editLink": "Web/RoleAssignments/GetByPrincipalId(3)/Member",
                "Users@odata.navigationLinkUrl": "Web/RoleAssignments/GetByPrincipalId(3)/Member/Users",
                "Users": [
                    {
                        "odata.type": "SP.User",
                        "odata.id": "https://<tenant>.sharepoint.com/sites/TestSite/_api/Web/GetUserById(8)",
                        "odata.editLink": "Web/GetUserById(8)",
                        "Id": 8,
                        "IsHiddenInUI": true,
                        "LoginName": "c:0o.c|federateddirectoryclaimprovider|<some hexadecimal ID>_o",
                        "Title": "Besitzer von TestSite",
                        "PrincipalType": 4,
                        "Email": "TestSite@<tenant>.onmicrosoft.com",
                        "Expiration": "",
                        "IsEmailAuthenticationGuestUser": false,
                        "IsShareByEmailGuestUser": false,
                        "IsSiteAdmin": true,
                        "UserId": null,
                        "UserPrincipalName": null
                    }
                ],
                "Id": 3,
                "IsHiddenInUI": false,
                "LoginName": "TestSite Owners",
                "Title": "TestSite Owners",
                "PrincipalType": 8,
                "AllowMembersEditMembership": false,
                "AllowRequestToJoinLeave": false,
                "AutoAcceptRequestToJoinLeave": false,
                "Description": null,
                "OnlyAllowMembersViewMembership": false,
                "OwnerTitle": "TestSite Owners",
                "RequestToJoinLeaveEmailSetting": ""
            },
            "PrincipalId": 3
        }
    ]
}

Now, according to the microsoft documentation, PrincipalType 4 means that the "user" really is a "SecurityGroup". In our test system, the security group has an Azure ID which makes it relatively easy to get information on via the Graph API. But in our customer's system the ID is some 16 digit hexadecimal string in a format that I can't find anywhere else.

How can I find the members of this "SecurityGroup" via any API?

-1

try out : https://sharepoint_tenant/path_to_site/_api/Web/SiteGroups/GetByName('groupname')/users

You can select properties to return appending ?$select="properties to return"

1
  • It says the request is invalid. Also, I think this would only work for SharepointGroups (PrincipalType: 8) not SecurityGroups (PrincipalType: 4). Do you agree? Aug 26 '20 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.