Forum Discussion
Supported App-Only APIs for SharePoint Site Access and Group Membership (No PowerShell)?
a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; }
I am trying to determine the supported approach for retrieving SharePoint Site Owners, Members, and Visitors (effective user access) in an App-Only (Application Permissions) scenario without using PowerShell.
Specifically, I am building an MCP tool that needs to:
- Check whether a specific user has access to a particular SharePoint site.
- Retrieve the list of users who have access to a SharePoint site, especially through the SharePoint Owners, Members, and Visitors groups.
From my understanding, Microsoft Graph can be used to enumerate SharePoint sites and permissions, but retrieving the actual membership of the associated SharePoint groups does not appear to be fully supported through Graph alone. Most recommendations I have found suggest using SharePoint REST APIs, CSOM, or PnP-based solutions.
My questions are:
- How can I retrieve SharePoint Site Owners, Members, and Visitors (effective user access) in an App-Only scenario without using PowerShell?
- Are there any supported Microsoft Graph APIs (including Beta APIs), SharePoint REST APIs, SDKs, Python libraries, CSOM, or other approaches that can provide this information?
- Can a backend service implemented entirely in code (without PowerShell execution) determine:
- Whether a specific user has access to a SharePoint site?
- The users belonging to the site's Owners, Members, and Visitors groups?
The reason for asking is that I am developing a backend service, and invoking PowerShell from the application is not a practical option. I am looking for a supported API/SDK-based solution that can be implemented directly in code using App Registration permissions only.
1 Reply
You do not need to invoke PowerShell: a backend can call SharePoint REST or the Microsoft SharePoint CSOM directly. Use an Entra application with certificate-based app-only authentication for SharePoint CSOM/REST, and obtain an administrator-approved permission scope appropriate to the operations. Enumerate the site's associated Owners, Members and Visitors groups and their Users collections. However, those collections are not a complete effective-access report: entries can include directory groups, and access can also come from other grants. Resolve directory-group membership separately where needed. For a named user, CSOM's Web.GetUserEffectivePermissions provides a permissions result; evaluate the required permission rather than treating group membership as proof of access. A successful permissions check also does not guarantee that Conditional Access will permit an interactive session. Keep Graph for supported directory operations, and avoid relying on an undocumented beta endpoint as your production authorization boundary.
