Add Role Assignment using Office 365 group

Question

Is it possible to use an Office365 group as the principalid for the addroleassignment function in SharePoint REST?

Trying to use Flow to copy a folder structure and then set permissions on some of the sub folders.

Answer 1

It is actually possible, I will sum it up in a blog post later on, but the steps which you need to take via API (in Power Automate, use the Send an HTTP request to SharePoint action):

• POST: _api/web/lists/getByTitle('Test')/items('4')/breakroleinheritance(copyRoleAssignments=false, clearSubscopes=true)
• GET: _api/web/siteusers('c:0t.c|tenant|<your_aad_group_id>')
• POST: _api/web/lists/getByTitle('Test')/items('4')/roleassignments/addroleassignment(principalid=<previousrequest[d][Id]>,roledefid=<your_role_id>)

Role ID for Full Control: 1073741829, Contribute: 1073741827 and Read: 1073741826. If you make your own, just get the ID from URL when modifying the role or use the /_api/web/roledefinitions endpoint.

And yes, it's very obscure and I wish Microsoft made it as easy as with Document Libraries.

More extended is in my blog post: https://blog.thenetw.org/2020/11/27/setting-sharepoint-item-permissions-to-aad-group/

Answer 2

No I think it's not possible to use Office365 group as the principal in rest API. SharePoint rest API (add role assignment function) is scoped in SharePoint service, while Office 365 group is for the tenant and it's stored as directory object in Azure AD. They're 2 different concepts.