Supported App-Only APIs for SharePoint Site Access and Group Membership (No PowerShell)?

a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; }

I am trying to determine the supported approach for retrieving SharePoint Site Owners, Members, and Visitors (effective user access) in an App-Only (Application Permissions) scenario without using PowerShell.

Specifically, I am building an MCP tool that needs to:

• Check whether a specific user has access to a particular SharePoint site.
• Retrieve the list of users who have access to a SharePoint site, especially through the SharePoint Owners, Members, and Visitors groups.

From my understanding, Microsoft Graph can be used to enumerate SharePoint sites and permissions, but retrieving the actual membership of the associated SharePoint groups does not appear to be fully supported through Graph alone. Most recommendations I have found suggest using SharePoint REST APIs, CSOM, or PnP-based solutions.

My questions are:

1. How can I retrieve SharePoint Site Owners, Members, and Visitors (effective user access) in an App-Only scenario without using PowerShell?
2. Are there any supported Microsoft Graph APIs (including Beta APIs), SharePoint REST APIs, SDKs, Python libraries, CSOM, or other approaches that can provide this information?
3. Can a backend service implemented entirely in code (without PowerShell execution) determine:
   • Whether a specific user has access to a SharePoint site?
   • The users belonging to the site's Owners, Members, and Visitors groups?

The reason for asking is that I am developing a backend service, and invoking PowerShell from the application is not a practical option. I am looking for a supported API/SDK-based solution that can be implemented directly in code using App Registration permissions only.