Microsoft Graph PowerShell SDK Module OneDrive Folder Permissions Assignment

In the PnP Online code example, I had a question for the $securityGroupToAdd = "Group1" parameter, was this an AzureAD classic security group, a Microsoft 365 security group, or a SharePoint Site Collection Security Group?

I used the script above for one project they are wanting to adapt it to add an AzureAD classic security group that has no email, so just curious if you got that to work or not because my attempts fail and there is no -group attribute on Set-PnPFolderPermission function.

Thanks again for all your help!

Tristan999 

Thank you for your reply, I greatly appreciate it! 

I will have to check into PnP I guess but here is what I have so far it is failing exactly at the invoke call as you pointed out, in your url for invite, that is where I have made it too!

These are the permissions that the connection has in Azure App:
GENERIC APP REG Permissions (Application)
TeamSettings.ReadWrite.All
Mail.ReadWrite
User.ReadWrite.All
Directory.ReadWrite.All
TeamsActivity.Send
Team.Create
Group.ReadWrite.All
User.Invite.All
Files.ReadWrite.All
TeamMember.ReadWrite.All
ServicePrincipalEndpoint.ReadWrite.All
Team.ReadBasic.All
Calendars.ReadWrite
Mail.Send
RoleManagement.ReadWrite.Directory
GroupMember.ReadWrite.All
Sites.FullControl.All
TeamsTab.ReadWriteForTeam.All

The file "myFolder" already exists in this test scenario, here is my code:

Import-Module Microsoft.Graph.Files

Connect-MgGraph `
	-ClientId "{Some long GUID from when you created the Azure App}" # Get in Registered App Settings in Azure Portal `
	-TenantId "{Some long GUID of your Microsoft 365 Tenant}" # Can get in Azure Portal or in Registered App Settings in Azure Portal `
	-CertificateThumbprint "{Some long passphrase of letters and numbers}" Get when you created the Registered Azure App

#The Admin user that needs access to migrate files over from on-prem 2013 to online OneDrive4B
$adminUserUPN = "email address removed for privacy reasons"
$adminUser = Get-MgUser -Filter "UserPrincipalName eq '$adminUserUPN'"
$adminUserId = $adminUser.Id

#User selected for the test run
$userUPN = "email address removed for privacy reasons"
$user = Get-MgUser -Filter "UserPrincipalName eq '$userUPN'"
$userId = $user.Id

$userOneDrive = Get-MgUserDrive -UserId $userId
$userDriveId = $userOneDrive.Id
$userDriveItems = Get-MgUserDriveListItem -DriveId $userDriveId  -UserId $userId
$userFolder = Get-MgUserDriveListItem -DriveId $userDriveId -UserId $userId -Search "Documents" | Where-Object { $_.WebUrl -like "*myFolder*" }
$userFolderId = $userFolder.Id

$params = @{
	recipients = @(
		@{
			email = $userUPN
		}
	)
	message = "it worked"
	requireSignIn = $true
	sendInvitation = $true
	retainInheritedPermissions = $true
	roles = @(
		"write"
	)
}

Invoke-MgInviteDriveItem -DriveId $userDriveId -DriveItemId $userFolderId  -UserId $userId -BodyParameter $params

#I have also tried these and fail, I wonder given the error at times if the DriveItemId is correct or not
#New-MgUserDriveItemPermission -DriveId $userDriveId -DriveItemId $userFolderId  -UserId $userId -BodyParameter $params
#Grant-MgUserDriveItemPermission -DriveId $userDriveId -DriveItemId $userFolderId  -UserId $userId -BodyParameter $params