Microsoft Graph API and SharePoint files permissions - powershell

Question

I try with no success to give read or write access to an existing user (Office 365) on a Sharepoint drive folder.
With Graph Explorer the URL is like :
https://graph.microsoft.com/v1.0/sites/{site id}/drive/items/{folder id}/permissions
I can get actual permissions with GET method, but with POST method and this body I've got Invalid Request :
{
"grantedToV2": {
"user": {
"id": "xxxxxxx",
"displayName": "xxx xxx"
}
},
"roles": [
"read"
]
}
I tried with the powershell SDK and the New-MgDriveItemPermission too with no success.
Any help is welcome !

Answer 1

In order to add permissions to an you will have to make a POST request to the below endpoint:
https://graph.microsoft.com/v1.0/sites/{site-id}/drive/items/{folder-id}/invite
With the body containing all the info about the invitation request as the below example:
{
"requireSignIn": false,
"sendInvitation": false,
"roles": [ "read | write"],
"recipients": [
{
"email": "{email of the user}"
}
],
"message": "string"
}
If your request is succesful the response you will get back will be of the below format:
Status: 200
{
"#odata.context": "https://graph.microsoft.com/v1.0/$metadata#Collection(permission)",
"value": [
{
"#odata.type": "#microsoft.graph.permission",
"id": "<some id>",
"roles": [
"write"
],
"grantedTo": {
"user": {
"email": "<user>#<tenant>.onmicrosoft.com",
"id": "<some id>",
"displayName": "<user's display name>"
}
}
}
]
}
Below I will share with you the code snippet I got from Graph Explorer after creating a succesful request:
GraphServiceClient graphClient = new GraphServiceClient( authProvider );
var recipients = new List<DriveRecipient>()
{
new DriveRecipient
{
Email = "<user>#<tenant>.onmicrosoft.com"
}
};
var message = "Here's the file that we're collaborating on.";
var requireSignIn = true;
var sendInvitation = true;
var roles = new List<String>()
{
"write"
};
await graphClient.Sites["root"].Drive.Items["<folder-id>"]
.Invite(recipients,requireSignIn,roles,sendInvitation,message,null,null,null)
.Request()
.PostAsync();
Notes
You can find documentation about the endpoint here.
If you try to add permissions to a Folder that inherits its permission model from the document library, you should watch out because in some cases if the user is not a member of the site groups, MS Graph might invoke unique permissions on the folder.