Forum Discussion
Microsoft Graph PowerShell SDK Module OneDrive Folder Permissions Assignment
It would be helpful if you posted some code snippets for the Graph request.
I am not sure if you are stuck with Microsoft Graph PowerShell, but I was able to do what you needed to do with PnP PowerShell:
$url = "<ONEDRIVEURL>"
Connect-PnPOnline -Url $url -Interactive
$oneDriveDefaultListName = "Documents"
$folderToCreate = "myFolder"
$securityGroupToAdd = "Group1"
$permission = "Contribute"
Add-PnPFolder -Name $folderToCreate -Folder $oneDriveDefaultListName
Set-PnPFolderPermission -List $oneDriveDefaultListName -Identity "$oneDriveDefaultListName/$folderToCreate" -User $securityGroupToAdd -AddRole $permission
If you are stuck with Graph API (and Azure Security Groups), maybe take a look at these links:Send an invite to access an item - Microsoft Graph v1.0 | Microsoft Learn
https://learn.microsoft.com/en-us/graph/api/resources/driverecipient?view=graph-rest-1.0#properties
It would be helpful if you posted some code snippets for the Graph request.
I am not sure if you are stuck with Microsoft Graph PowerShell, but I was able to do what you needed to do with PnP PowerShell:
$url = "<ONEDRIVEURL>"
Connect-PnPOnline -Url $url -Interactive
$oneDriveDefaultListName = "Documents"
$folderToCreate = "myFolder"
$securityGroupToAdd = "Group1"
$permission = "Contribute"
Add-PnPFolder -Name $folderToCreate -Folder $oneDriveDefaultListName
Set-PnPFolderPermission -List $oneDriveDefaultListName -Identity "$oneDriveDefaultListName/$folderToCreate" -User $securityGroupToAdd -AddRole $permission
If you are stuck with Graph API (and Azure Security Groups), maybe take a look at these links:
Send an invite to access an item - Microsoft Graph v1.0 | Microsoft Learn
https://learn.microsoft.com/en-us/graph/api/resources/driverecipient?view=graph-rest-1.0#properties
Thank you for your reply, I greatly appreciate it!
I will have to check into PnP I guess but here is what I have so far it is failing exactly at the invoke call as you pointed out, in your url for invite, that is where I have made it too!
These are the permissions that the connection has in Azure App:
GENERIC APP REG Permissions (Application)
TeamSettings.ReadWrite.All
Mail.ReadWrite
User.ReadWrite.All
Directory.ReadWrite.All
TeamsActivity.Send
Team.Create
Group.ReadWrite.All
User.Invite.All
Files.ReadWrite.All
TeamMember.ReadWrite.All
ServicePrincipalEndpoint.ReadWrite.All
Team.ReadBasic.All
Calendars.ReadWrite
Mail.Send
RoleManagement.ReadWrite.Directory
GroupMember.ReadWrite.All
Sites.FullControl.All
TeamsTab.ReadWriteForTeam.All
The file "myFolder" already exists in this test scenario, here is my code:
Import-Module Microsoft.Graph.Files
Connect-MgGraph `
-ClientId "{Some long GUID from when you created the Azure App}" # Get in Registered App Settings in Azure Portal `
-TenantId "{Some long GUID of your Microsoft 365 Tenant}" # Can get in Azure Portal or in Registered App Settings in Azure Portal `
-CertificateThumbprint "{Some long passphrase of letters and numbers}" Get when you created the Registered Azure App
#The Admin user that needs access to migrate files over from on-prem 2013 to online OneDrive4B
$adminUserUPN = "email address removed for privacy reasons"
$adminUser = Get-MgUser -Filter "UserPrincipalName eq '$adminUserUPN'"
$adminUserId = $adminUser.Id
#User selected for the test run
$userUPN = "email address removed for privacy reasons"
$user = Get-MgUser -Filter "UserPrincipalName eq '$userUPN'"
$userId = $user.Id
$userOneDrive = Get-MgUserDrive -UserId $userId
$userDriveId = $userOneDrive.Id
$userDriveItems = Get-MgUserDriveListItem -DriveId $userDriveId -UserId $userId
$userFolder = Get-MgUserDriveListItem -DriveId $userDriveId -UserId $userId -Search "Documents" | Where-Object { $_.WebUrl -like "*myFolder*" }
$userFolderId = $userFolder.Id
$params = @{
recipients = @(
@{
email = $userUPN
}
)
message = "it worked"
requireSignIn = $true
sendInvitation = $true
retainInheritedPermissions = $true
roles = @(
"write"
)
}
Invoke-MgInviteDriveItem -DriveId $userDriveId -DriveItemId $userFolderId -UserId $userId -BodyParameter $params
#I have also tried these and fail, I wonder given the error at times if the DriveItemId is correct or not
#New-MgUserDriveItemPermission -DriveId $userDriveId -DriveItemId $userFolderId -UserId $userId -BodyParameter $params
#Grant-MgUserDriveItemPermission -DriveId $userDriveId -DriveItemId $userFolderId -UserId $userId -BodyParameter $paramsCan you post the error that you get from running the command?
Invoke-MgInviteDriveItem
Also, your original post talked about using a Security Group. Is it a mail-enabled group?
I posted the link for the drive recipient just in case it is not a mail-enabled group. In which case, you may want to use something like the alias or objectid instead of email:
$params = @{
recipients = @(
@{
alias = $userAlias
}
)
message = "it worked"
requireSignIn = $true
sendInvitation = $true
retainInheritedPermissions = $true
roles = @(
"write"
)
}Here are some additional resources, you may want to look at
Graph Explorer | Try Microsoft Graph APIs - Microsoft Graph
I'll take a look at your code later and test it out on my end.
Tristan999 Again, can't thank you enough for the help, greatly appreciated it! Right now I am just trying to get it to work with a single user via email (Which is the same as the UPN in our case) trying to keep it simple! But yeah I was thinking ObjectId would be the best for the security group once I got that far as it is NOT an Microsoft 365 group (Or email enabled group) but a classic "Security" group object in Azure AD portal. The error I get for Invoke-MgInviteDriveItem command is the following:
PS C:\> Invoke-MgInviteDriveItem -DriveId $userDriveId -DriveItemId $userFolderId -BodyParameter $params Invoke-MgInviteDriveItem_Invite: The resource could not be found. Status: 404 (NotFound) ErrorCode: itemNotFound Date: 2023-10-09T17:35:29 Headers: Cache-Control : no-store, no-cache Transfer-Encoding : chunked Vary : Accept-Encoding Strict-Transport-Security : max-age=31536000 request-id : b7639245-1f38-4e2c-abbb-0d0a1c7967ea client-request-id : 800ea0c0-950b-44a5-a08a-032da706caf5 x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"North Central US","Slice":"E","Ring":"3","ScaleUnit":"000","RoleInstance":"CH01EPF0000D3FC"}} Link : <https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=v1.0,Removal&from=2021-09-01&to=2021-10-01>;rel="deprecation";type="text/html",<https://developer.microsoft-tst.com/en-us/graph/changes?$filterby=v1.0,Removal&from=2021-09-01&to=2021-10-01>;rel="deprecation";type="text/html" Deprecation : Fri, 03 Sep 2021 23:59:59 GMT Sunset : Sun, 01 Oct 2023 23:59:59 GMT Date : Mon, 09 Oct 2023 17:35:28 GMT
When I run it and put in the eTag id instead of the driveItemIdPS C:\> $userFolder CreatedDateTime Description ETag Id LastModifiedDateTime Name WebUrl --------------- ----------- ---- -- -------------------- ---- ------ 10/2/2023 6:26:05 PM "f2c5a1f9-06f8-****-****-de18****8bc4,4" 1 10/9/2023 4:26:15 PM https://tenant-my.sharepoint.com/personal/john_smith_tenant_onmicrosoft_com/Documents/myFolderJust the GUID part I end up with this outcome, but the user does not end up added when looking at the permissions
PS C:\> Invoke-MgInviteDriveItem -DriveId $userDriveId -DriveItemId f2c5a1f9-****-****-9840-de********c4 -BodyParameter $params Id ExpirationDateTime HasPassword Roles ShareId -- ------------------ ----------- ----- ------- aTo*********WJlcnNoaX**********ZW5lc2lzQDB3bHNnLm9**********2Z0L**vbQ {write}
The expected outcome for the script when it runs and does not error out is to see the user listed on the folder permissions which doesn't happen, still shows the old permissions of only the owner listed for the folder
I thought Grant-MgUserDriveItemPermission might be the golden ticket since I am running under an AppOnly Application Connection and not delegate it might need the MgUser piece in the command as we are trying to manipulate another OneDrive users Drive and not our own, but it ends for me at the "PermissionId" because I am not sure what that is meaning, i.e. is that the id assigned to the contribute permision object itself for the site collection, and if so how I get that from graph, I do not know!:PS C:\> Grant-MgUserDriveItemPermission -DriveId $userDriveId -DriveItemId f2c5a1f9-****-****-9840-de********c4 -UserId $userId -BodyParameter $params cmdlet Grant-MgUserDriveItemPermission at command pipeline position 1 Supply values for the following parameters: PermissionId:
Of course that could just be a wild goose chase too! Thanks again for the help on this!
SG.So, I found a few things when using the Graph and your code:
#1:
$userDriveItems = Get-MgUserDriveListItem -DriveId $userDriveId -UserId $userId** Much like the PnP solution, if you do not have access to the User's OneDrive, this request will return null. So, you'll have to take a look at the following:- Check/Add your access to the site collection admin.
- Remove after the request is done. For my test, I just added/removed it through the OneDrive UI.
#2:
The drive item id is not what you would expect it to be, i.e., it's not the list item id from SharePoint. I wanted to timebox the amount of time I spent. So, I cheated by using the Graph Explorer site and got the id from there (It looks like you will have to do some investigation using the command Get-MgDriveItemChild😞
#3:
I was getting an error with the -UserId param, so I just removed it and replaced the drive item id I got from graph explorer:
Invoke-MgInviteDriveItem -DriveId $userDriveId -DriveItemId "01TWBMQNWPEDAAW7ZE25EYOD5TZPWGX3EF" -BodyParameter $params
I did get an email. However, when I click the link I get an access denied. You will have to take a look at that issue (perhaps try to play around your params OR check this link Change sharing permissions - Microsoft Graph v1.0 | Microsoft Learn)
Hopefully, this helps you a lot 🙂