Is it possible to use an Office365 group as the principalid for the addroleassignment function in SharePoint REST?

Trying to use Flow to copy a folder structure and then set permissions on some of the sub folders.

2 Answers 2


It is actually possible, I will sum it up in a blog post later on, but the steps which you need to take via API (in Power Automate, use the Send an HTTP request to SharePoint action):

  • POST: _api/web/lists/getByTitle('Test')/items('4')/breakroleinheritance(copyRoleAssignments=false, clearSubscopes=true)
  • GET: _api/web/siteusers('c:0t.c|tenant|<your_aad_group_id>')
  • POST: _api/web/lists/getByTitle('Test')/items('4')/roleassignments/addroleassignment(principalid=<previousrequest[d][Id]>,roledefid=<your_role_id>)

Role ID for Full Control: 1073741829, Contribute: 1073741827 and Read: 1073741826. If you make your own, just get the ID from URL when modifying the role or use the /_api/web/roledefinitions endpoint.

And yes, it's very obscure and I wish Microsoft made it as easy as with Document Libraries.

More extended is in my blog post: https://blog.thenetw.org/2020/11/27/setting-sharepoint-item-permissions-to-aad-group/


No I think it's not possible to use Office365 group as the principal in rest API. SharePoint rest API (add role assignment function) is scoped in SharePoint service, while Office 365 group is for the tenant and it's stored as directory object in Azure AD. They're 2 different concepts.

  • Thanks. Still working through issue. Can I add 365 group to the SP group to make it work that way? Nov 7, 2020 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.