Is it possible to use an Office365 group as the principalid for the addroleassignment function in SharePoint REST?
Trying to use Flow to copy a folder structure and then set permissions on some of the sub folders.
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It only takes a minute to sign up.
Sign up to join this communityIt is actually possible, I will sum it up in a blog post later on, but the steps which you need to take via API (in Power Automate, use the Send an HTTP request to SharePoint
action):
_api/web/lists/getByTitle('Test')/items('4')/breakroleinheritance(copyRoleAssignments=false, clearSubscopes=true)
_api/web/siteusers('c:0t.c|tenant|<your_aad_group_id>')
_api/web/lists/getByTitle('Test')/items('4')/roleassignments/addroleassignment(principalid=<previousrequest[d][Id]>,roledefid=<your_role_id>)
Role ID for Full Control: 1073741829, Contribute: 1073741827 and Read: 1073741826. If you make your own, just get the ID from URL when modifying the role or use the /_api/web/roledefinitions
endpoint.
And yes, it's very obscure and I wish Microsoft made it as easy as with Document Libraries.
More extended is in my blog post: https://blog.thenetw.org/2020/11/27/setting-sharepoint-item-permissions-to-aad-group/
No I think it's not possible to use Office365 group as the principal in rest API. SharePoint rest API (add role assignment function) is scoped in SharePoint service, while Office 365 group is for the tenant and it's stored as directory object in Azure AD. They're 2 different concepts.