A customer of ours has their Sharepoint Online access permissions configured via (non-azure) security groups.

We query the roles attached to an item in Sharepoint via the Sharepoint REST API with the following request:


And the response looks something like this:

    "odata.metadata": "https://<tenant>.sharepoint.com/sites/TestSite/_api/$metadata#SP.ApiData.RoleAssignments",
    "value": [
            "odata.type": "SP.RoleAssignment",
            "odata.id": "https://<tenant>.sharepoint.com/sites/TestSite/_api/Web/RoleAssignments/GetByPrincipalId(3)",
            "odata.editLink": "Web/RoleAssignments/GetByPrincipalId(3)",
            "[email protected]": "Web/RoleAssignments/GetByPrincipalId(3)/Member",
            "Member": {
                "odata.type": "SP.Group",
                "odata.id": "https://<tenant>.sharepoint.com/sites/TestSite/_api/Web/RoleAssignments/GetByPrincipalId(3)/Member",
                "odata.editLink": "Web/RoleAssignments/GetByPrincipalId(3)/Member",
                "[email protected]": "Web/RoleAssignments/GetByPrincipalId(3)/Member/Users",
                "Users": [
                        "odata.type": "SP.User",
                        "odata.id": "https://<tenant>.sharepoint.com/sites/TestSite/_api/Web/GetUserById(8)",
                        "odata.editLink": "Web/GetUserById(8)",
                        "Id": 8,
                        "IsHiddenInUI": true,
                        "LoginName": "c:0o.c|federateddirectoryclaimprovider|<some hexadecimal ID>_o",
                        "Title": "Besitzer von TestSite",
                        "PrincipalType": 4,
                        "Email": "TestSite@<tenant>.onmicrosoft.com",
                        "Expiration": "",
                        "IsEmailAuthenticationGuestUser": false,
                        "IsShareByEmailGuestUser": false,
                        "IsSiteAdmin": true,
                        "UserId": null,
                        "UserPrincipalName": null
                "Id": 3,
                "IsHiddenInUI": false,
                "LoginName": "TestSite Owners",
                "Title": "TestSite Owners",
                "PrincipalType": 8,
                "AllowMembersEditMembership": false,
                "AllowRequestToJoinLeave": false,
                "AutoAcceptRequestToJoinLeave": false,
                "Description": null,
                "OnlyAllowMembersViewMembership": false,
                "OwnerTitle": "TestSite Owners",
                "RequestToJoinLeaveEmailSetting": ""
            "PrincipalId": 3

Now, according to the microsoft documentation, PrincipalType 4 means that the "user" really is a "SecurityGroup". In our test system, the security group has an Azure ID which makes it relatively easy to get information on via the Graph API. But in our customer's system the ID is some 16 digit hexadecimal string in a format that I can't find anywhere else.

How can I find the members of this "SecurityGroup" via any API?

1 Answer 1


try out : https://sharepoint_tenant/path_to_site/_api/Web/SiteGroups/GetByName('groupname')/users

You can select properties to return appending ?$select="properties to return"

  • 1
    It says the request is invalid. Also, I think this would only work for SharepointGroups (PrincipalType: 8) not SecurityGroups (PrincipalType: 4). Do you agree? Aug 26, 2020 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.