Forum Discussion

Copper Contributor

Sep 28, 2023

Solved

Microsoft Graph PowerShell SDK Module OneDrive Folder Permissions Assignment

As an M365 Global Admin, I have been tasked with creating a new folder in other users OneDrive root folder (Documents) we can call that folder 'myFolder', then I need to assign a Microsoft Azure Secu...

microsoft 365 admin center

Tristan999
Oct 06, 2023
It would be helpful if you posted some code snippets for the Graph request.

I am not sure if you are stuck with Microsoft Graph PowerShell, but I was able to do what you needed to do with PnP PowerShell:

$url = "<ONEDRIVEURL>"
Connect-PnPOnline -Url $url -Interactive
$oneDriveDefaultListName = "Documents"
$folderToCreate = "myFolder"
$securityGroupToAdd = "Group1"
$permission = "Contribute"
Add-PnPFolder -Name $folderToCreate -Folder $oneDriveDefaultListName
Set-PnPFolderPermission -List $oneDriveDefaultListName -Identity "$oneDriveDefaultListName/$folderToCreate" -User $securityGroupToAdd -AddRole $permission

If you are stuck with Graph API (and Azure Security Groups), maybe take a look at these links:

Send an invite to access an item - Microsoft Graph v1.0 | Microsoft Learn

https://learn.microsoft.com/en-us/graph/api/resources/driverecipient?view=graph-rest-1.0#properties

Tristan999

Iron Contributor

Oct 09, 2023

ShaneGibson

So, I found a few things when using the Graph and your code:

#1:

$userDriveItems = Get-MgUserDriveListItem -DriveId $userDriveId -UserId $userId

** Much like the PnP solution, if you do not have access to the User's OneDrive, this request will return null. So, you'll have to take a look at the following:

Check/Add your access to the site collection admin.
Remove after the request is done. For my test, I just added/removed it through the OneDrive UI.

#2:

The drive item id is not what you would expect it to be, i.e., it's not the list item id from SharePoint. I wanted to timebox the amount of time I spent. So, I cheated by using the Graph Explorer site and got the id from there (It looks like you will have to do some investigation using the command Get-MgDriveItemChild😞

#3:

I was getting an error with the -UserId param, so I just removed it and replaced the drive item id I got from graph explorer:

Invoke-MgInviteDriveItem -DriveId $userDriveId -DriveItemId "01TWBMQNWPEDAAW7ZE25EYOD5TZPWGX3EF" -BodyParameter $params

I did get an email. However, when I click the link I get an access denied. You will have to take a look at that issue (perhaps try to play around your params OR check this link Change sharing permissions - Microsoft Graph v1.0 | Microsoft Learn)

Hopefully, this helps you a lot 🙂

Tristan999

Iron Contributor

Oct 09, 2023

The issue for the access denied was $retainInheritedPermissions = $true. You will need to set this to false as it would prevent the permission from being modified.