Forum Discussion
ShaneGibson
Sep 28, 2023Copper Contributor
Microsoft Graph PowerShell SDK Module OneDrive Folder Permissions Assignment
As an M365 Global Admin, I have been tasked with creating a new folder in other users OneDrive root folder (Documents) we can call that folder 'myFolder', then I need to assign a Microsoft Azure Security group ('myGroup') to that folder with read/write permissions. I have a list of users (taking input from txt file of UPNs), and am able to loop through the users and create the folder, so step one is possible, but where I am failing is the assignment of the permissions, am using PowerShell 7 and the MS Graph PowerShell Mod, actually for the folder creation I used the API and invoke-method, but I am running into problems since OneDrive is on top of SharePoint, I am not sure how to accomplish this task. Any help would be greatly appreciated!
It would be helpful if you posted some code snippets for the Graph request.
I am not sure if you are stuck with Microsoft Graph PowerShell, but I was able to do what you needed to do with PnP PowerShell:
$url = "<ONEDRIVEURL>"
Connect-PnPOnline -Url $url -Interactive
$oneDriveDefaultListName = "Documents"
$folderToCreate = "myFolder"
$securityGroupToAdd = "Group1"
$permission = "Contribute"
Add-PnPFolder -Name $folderToCreate -Folder $oneDriveDefaultListName
Set-PnPFolderPermission -List $oneDriveDefaultListName -Identity "$oneDriveDefaultListName/$folderToCreate" -User $securityGroupToAdd -AddRole $permission
If you are stuck with Graph API (and Azure Security Groups), maybe take a look at these links:Send an invite to access an item - Microsoft Graph v1.0 | Microsoft Learn
https://learn.microsoft.com/en-us/graph/api/resources/driverecipient?view=graph-rest-1.0#properties
- Tristan999Iron Contributor
It would be helpful if you posted some code snippets for the Graph request.
I am not sure if you are stuck with Microsoft Graph PowerShell, but I was able to do what you needed to do with PnP PowerShell:
$url = "<ONEDRIVEURL>"
Connect-PnPOnline -Url $url -Interactive
$oneDriveDefaultListName = "Documents"
$folderToCreate = "myFolder"
$securityGroupToAdd = "Group1"
$permission = "Contribute"
Add-PnPFolder -Name $folderToCreate -Folder $oneDriveDefaultListName
Set-PnPFolderPermission -List $oneDriveDefaultListName -Identity "$oneDriveDefaultListName/$folderToCreate" -User $securityGroupToAdd -AddRole $permission
If you are stuck with Graph API (and Azure Security Groups), maybe take a look at these links:Send an invite to access an item - Microsoft Graph v1.0 | Microsoft Learn
https://learn.microsoft.com/en-us/graph/api/resources/driverecipient?view=graph-rest-1.0#properties- ShaneGibsonCopper Contributor
In the PnP Online code example, I had a question for the $securityGroupToAdd = "Group1" parameter, was this an AzureAD classic security group, a Microsoft 365 security group, or a SharePoint Site Collection Security Group?
I used the script above for one project they are wanting to adapt it to add an AzureAD classic security group that has no email, so just curious if you got that to work or not because my attempts fail and there is no -group attribute on Set-PnPFolderPermission function.
Thanks again for all your help!- Tristan999Iron ContributorGroup1 is an Azure AD Security Group (in all the examples). The Set-PnPFolderPermission User parameter does not distinguish between an Azure Security Group and a user (email address removed for privacy reasons). I haven't tried using a SharePoint group with that command, but according to the documentation here https://pnp.github.io/powershell/cmdlets/Set-PnPFolderPermission.html, the -Group parameter seems to be used if you want assign permissions to a SharePoint group.
FYI. In the case, of the Graph example, even though the group was not mail-enabled, the group members still received emails since those accounts have emails tied to them.
Hopefully that helps!
- ShaneGibsonCopper ContributorJust to confirm the PnP Powershell does work, I would still like to get it done in Graph, but wanted to say that my test with PnP Powershell with your post worked properly! I did have to add myself as a site collection admin on the onedrive site though. I will post error and answer questions for MS Graph after my meeting but thank you again for the help, greatly appreciate it!
- Tristan999Iron ContributorNo problem! PnP is just a wrapper, in the backend it's probably using Graph/CSOM. Yes, I forgot to mention that you will have to add two additional lines to add yourself to the site collection admin for one drive that you do not own and then remove yourself.
- ShaneGibsonCopper Contributor
Thank you for your reply, I greatly appreciate it!
I will have to check into PnP I guess but here is what I have so far it is failing exactly at the invoke call as you pointed out, in your url for invite, that is where I have made it too!
These are the permissions that the connection has in Azure App:
GENERIC APP REG Permissions (Application)
TeamSettings.ReadWrite.All
Mail.ReadWrite
User.ReadWrite.All
Directory.ReadWrite.All
TeamsActivity.Send
Team.Create
Group.ReadWrite.All
User.Invite.All
Files.ReadWrite.All
TeamMember.ReadWrite.All
ServicePrincipalEndpoint.ReadWrite.All
Team.ReadBasic.All
Calendars.ReadWrite
Mail.Send
RoleManagement.ReadWrite.Directory
GroupMember.ReadWrite.All
Sites.FullControl.All
TeamsTab.ReadWriteForTeam.AllThe file "myFolder" already exists in this test scenario, here is my code:
Import-Module Microsoft.Graph.Files Connect-MgGraph ` -ClientId "{Some long GUID from when you created the Azure App}" # Get in Registered App Settings in Azure Portal ` -TenantId "{Some long GUID of your Microsoft 365 Tenant}" # Can get in Azure Portal or in Registered App Settings in Azure Portal ` -CertificateThumbprint "{Some long passphrase of letters and numbers}" Get when you created the Registered Azure App #The Admin user that needs access to migrate files over from on-prem 2013 to online OneDrive4B $adminUserUPN = "email address removed for privacy reasons" $adminUser = Get-MgUser -Filter "UserPrincipalName eq '$adminUserUPN'" $adminUserId = $adminUser.Id #User selected for the test run $userUPN = "email address removed for privacy reasons" $user = Get-MgUser -Filter "UserPrincipalName eq '$userUPN'" $userId = $user.Id $userOneDrive = Get-MgUserDrive -UserId $userId $userDriveId = $userOneDrive.Id $userDriveItems = Get-MgUserDriveListItem -DriveId $userDriveId -UserId $userId $userFolder = Get-MgUserDriveListItem -DriveId $userDriveId -UserId $userId -Search "Documents" | Where-Object { $_.WebUrl -like "*myFolder*" } $userFolderId = $userFolder.Id $params = @{ recipients = @( @{ email = $userUPN } ) message = "it worked" requireSignIn = $true sendInvitation = $true retainInheritedPermissions = $true roles = @( "write" ) } Invoke-MgInviteDriveItem -DriveId $userDriveId -DriveItemId $userFolderId -UserId $userId -BodyParameter $params #I have also tried these and fail, I wonder given the error at times if the DriveItemId is correct or not #New-MgUserDriveItemPermission -DriveId $userDriveId -DriveItemId $userFolderId -UserId $userId -BodyParameter $params #Grant-MgUserDriveItemPermission -DriveId $userDriveId -DriveItemId $userFolderId -UserId $userId -BodyParameter $params
- Tristan999Iron Contributor
Can you post the error that you get from running the command?
Invoke-MgInviteDriveItem
Also, your original post talked about using a Security Group. Is it a mail-enabled group?
I posted the link for the drive recipient just in case it is not a mail-enabled group. In which case, you may want to use something like the alias or objectid instead of email:
$params = @{
recipients = @(
@{
alias = $userAlias
}
)
message = "it worked"
requireSignIn = $true
sendInvitation = $true
retainInheritedPermissions = $true
roles = @(
"write"
)
}Here are some additional resources, you may want to look at
Graph Explorer | Try Microsoft Graph APIs - Microsoft Graph
I'll take a look at your code later and test it out on my end.