Get SharePoint Groups (not AD groups) using Graph API - microsoft-graph-api

Is there a method to retrieve SharePoint Groups using Microsoft Graph?
I can get Azure Directory groups using https://graph.microsoft.com/v1.0/groups but what I'm looking for are SharePoint Groups.
I could get a SiteCollection using https://graph.microsoft.com/beta/sites/{id} but I couldn't seem to get the SharePoint Groups in site collection.

This is not very easily accessible in just the Microsoft Graph. If you had some access to the SharePoint API, you could get the GUID from the "User Information List" - which seems hidden from the Microsoft Graph at this time. That SharePoint API call would be
GET HTTP https://sometenant.sharepoint.com/_api/web/lists?$select=title,id&$filter=Title%20eq%20%27User%20Information%20List%27
Once you have that GUID for that list you could do the Graph call:
https://graph.microsoft.com/beta/sites/{site id}/lists/{list ID from the SharePoint API}/items
That will get you the full list of members, including groups. This is still a hack since the groups you'd have to filter by contentType/name eq 'SharePointGroup' - which seems buggy in Graph Explorer anyways. Trying to programmatically access that, would be difficult at this time.

Related

List mail transport rules of Admin using Microsoft Graph API

Microsoft Graph API has support to retrieve mail rules for individual mail boxes. Is there any API to get the list of rules configured by Admin for the organization?
https://graph.microsoft.com/v1.0/users/user-id/mailFolders/inbox/messagerules
Not that i am aware of using Microsoft Graph API. At this point Graph API supports only individual mailboxes. The closest one i can see is that you can application permission to query other mailboxes as well. But it won't tell or get you the list of rules configured by admin for the organization. Being said that you can consider filing an uservoice so that it can be considered to be implemented. As an alternate you can use from Exchange PowerShell (something like Get-Trasportrule).

Get role inheritance state for document library in SharePoint Online

I work with SharePoint Online drives(document libraries) with Microsoft Graph API (/drives call). With this API I can download/upload files but cannot work with permissions.
That's not a problem - I can do it with SharePoint Online REST API (with calls _api/web/GetListByTitle('Title')/hasuniqueroleassignments).
The main problem here is matching drive from MS Graph API and a corresponding list from SharePoint REST API. For now I match by title but I have several examples, when name field in MS Graph API is equal to "OneDrive", but title in List entity is Shared Pictures.
My question is: is there any way to match more precisely entities from Graph API and SharePoint REST API?
Thank you.
The Drive Item object has a SharePointIds property that will provide the information necessary to call the SharePoint REST API.
https://learn.microsoft.com/en-us/graph/api/resources/sharepointids?view=graph-rest-1.0
Use List resource, you could get list id.
Then use id to call rest api.
/_api/web/Lists(guid'54ca94c0-364e-4201-8fe7-a4c804769009')/hasuniqueroleassignments

It is possible to fetch user/mailbox type using Microsoft graph API?

I am trying to get informations about user/mailbox type (regular, distribution list, shared mailbox, alias) using the Microsoft graph API. I tried using the /users endpoint but I see there is no field with such info. Is there any way of doing this?
https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0&tabs=http
Thanks!
That information is only available from Exchange PowerShell (Get-Mailbox), which isn't yet available via Graph. You can get a list of groups (https://learn.microsoft.com/en-us/graph/api/group-list?view=graph-rest-1.0&tabs=http) and a list of users (https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0&tabs=http). I don't know if that will work for your purposes.

Why is Microsoft Graph more restrictive?

In outlook I can lookup all users in my organisation, including phone number, address etc.
I guess using EWS I could do the same...
With Azure AD graph (https://graph.windows.net) I can get ALL(!) properties on all (GAL) users as well - without the option to select a smaller property subset…
In Microsoft Graph (https://graph.microsoft.com) I can get all users (GAL), but not (all) properties like phone number, title etc. without an admin allows access… Why is this different (more restricted) than the other APIs ?
ex. the permission; Directory.AccessAsUser.All (Access the directory as the signed-in user)
In Microsoft Graph user is UNABLE to consent
In Azure AD Graph - does NOT require admin
Using the /me/people (in preview) in Microsoft Graph I can get all properties on a lot of users in my organisation - but not all. And I might get some users that my nearest colleague can’t (why? - is it still buggy)
Every one tell you to use Microsoft Graph but it seems to be more restricted than the old APIs
I'd be interested to know a little more about the restrictive nature that you are describing. For the most part (with respect to Directory/Azure AD), Microsoft Graph exposes the same data secured by the same permissions model as Azure AD Graph. Please see https://developer.microsoft.com/en-us/graph/docs/concepts/permissions_reference#user-permissions for more details on the available user permissions and what they allow.
What you might be seeing with Microsoft Graph is the fact that when you query the /users entity set in v1.0 (i.e. GET https://graph.microsoft.com/v1.0/users) Microsoft Graph will return only a key set of user properties by default. The user entity type is pretty big, and growing all the time - it has more than 40 properties and 25 navigation properties. Serializing and de-serializing large objects, especially when paging collections can be expensive and non-performant, both for the client and for the Microsoft Graph service. Hence we return a default set. If you want other properties then you need to use the $select parameter. For example: GET https://graph.microsoft.com/v1.0/users?$select=displayName,givenName, officeLocation,postalCode,state. This is documented here: https://developer.microsoft.com/en-us/graph/docs/api-reference/beta/api/user_get for example, but we are working on making some improvements to the documentation in this area too. If you want to see the full set of properties exposed by the Microsoft Graph user entity type, please look at the schema here: https://graph.microsoft.com/v1.0/$metadata.
[NOTE: $select is not supported in Azure AD Graph API, so we always return the full set].
The people API - ../me/people is about the people who you (the signed-in user) communicate with most often - it could also contain people outside of your organization. Hence, the list of people is likely specific and different for each user (even colleagues). It also is not the full directory of users in your organization.
I'd also like to get to the bottom of why you are seeing a difference in terms of consent - Directory.AccessAsUser.All always requires admin consent for web apps (for both Microsoft and Azure AD Graph).
Hope this helps,

Finding Microsoft Graph Scopes

Since Graph is a self-documenting language, I wanted to use this to my advantage and write PowerShell functions to automatically generate cmdlets based on metadata. I've got a lot of this complete, but am having problems figuring out scopes. Is there a way to find scopes? It's not stored in the metadata and the documentation doesn't have scopes listed for everything (for instance, nothing in Excel has scopes listed).
The Graph Explorer seems to request correct permissions, so that has access to this list somewhere.
It depends on which API you are looking for.
Scopes for Azure AD Graph API is at https://msdn.microsoft.com/library/azure/ad/graph/howto/azure-ad-graph-api-permission-scopes.
There is a huge list for different parts of the Microsoft Graph API at https://developer.microsoft.com/en-us/graph/docs/authorization/permission_scopes.
When you first sign in to Graph Explorer, you give it these permissions:
Based on the descriptions and the link above you can figure out what the scope name is for each of the items in the list. (E.g. the first one is Mail.ReadWrite).
When you create an application in Azure AD, you configure which applications it needs access to, and what access it needs. That results in the list which the user grants access to on first signin.

Resources