Skip to content

Commit 84cd10f

Browse files
FaithOmbongiFaithOmbongi
authored
Permissions fixes - get/check member objects/groups
1 parent a15247c commit 84cd10f

12 files changed

+73
-47
lines changed

‎api-reference/beta/api/directoryobject-checkmembergroups.md

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,14 @@ One of the following permissions is required to call this API. To learn more, in
3131
| Delegated (personal Microsoft account) | Not supported. |
3232
| Application | User.Read.All, Directory.Read.All |
3333

34+
### Group memberships for the signed-in user
35+
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
36+
| Permission type | Permissions (from least to most privileged) |
37+
|:-|:-|
38+
| Delegated (work or school account) | User.Read, User.ReadBasic.All, User.Read.All, Directory.Read.All, User.ReadWrite.All, Directory.ReadWrite.All |
39+
| Delegated (personal Microsoft account) | Not supported. |
40+
| Application | Not supported. |
41+
3442
### Group memberships for a user
3543
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
3644
| Permission type | Permissions (from least to most privileged) |
@@ -59,18 +67,6 @@ One of the following permissions is required to call this API. To learn more, in
5967
<!-- { "blockType": "permissions", "name": "directoryobject_checkmembergroups_5" } -->
6068
[!INCLUDE [permissions-table](../includes/permissions/directoryobject-checkmembergroups-5-permissions.md)]
6169

62-
<!--
63-
The following table lists the permission types to use for different scenarios.
64-
65-
| Scenario | Permissions |
66-
|:-|:-|
67-
| To get group memberships for the signed-in user | Use one of the following sets of permissions: <br/> <li> **User.Read** and **GroupMember.Read.All** <li>**User.Read** and **Group.Read.All** |
68-
| To get group memberships for any user | Use one of the following sets of permissions: <br/> <li> **User.ReadBasic.All** and **GroupMember.Read.All** <li>**User.Read.All** and **GroupMember.Read.All** <li>**User.ReadBasic.All** and **Group.Read.All** <li>**User.Read.All** and **Group.Read.All** |
69-
| To get group memberships for a group | Use either the **GroupMember.Read.All** or **Group.Read.All** permission. |
70-
| To get group memberships for a service principal | Use one of the following sets of permissions <br/> <li>**Application.ReadWrite.All** and **GroupMember.Read.All** <li>**Application.ReadWrite.All** and **Group.Read.All** |
71-
| To get group memberships for a directory object | Use the **Directory.Read.All** permission. |
72-
-->
73-
7470
## HTTP request
7571

7672
Group memberships for a directory object (user, group, service principal, or organizational contact).
@@ -79,10 +75,15 @@ Group memberships for a directory object (user, group, service principal, or org
7975
POST /directoryObjects/{id}/checkMemberGroups
8076
```
8177

82-
Group memberships for the signed-in user or other users.
78+
Group memberships for the signed-in user.
8379
<!-- { "blockType": "ignored" } -->
8480
```http
8581
POST /me/checkMemberGroups
82+
```
83+
84+
Group memberships for other users.
85+
<!-- { "blockType": "ignored" } -->
86+
```http
8687
POST /users/{id | userPrincipalName}/checkMemberGroups
8788
```
8889

‎api-reference/beta/api/directoryobject-checkmemberobjects.md

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,20 @@ One of the following permissions is required to call this API. To learn more, in
3030
|Delegated (personal Microsoft account) | Not supported. |
3131
|Application | Directory.Read.All |
3232

33-
### Memberships for a user
33+
### Memberships for the signed-in user
3434
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
3535
|Permission type | Permissions (from least to most privileged) |
3636
|:--------------------|:---------------------------------------------------------|
3737
|Delegated (work or school account) | User.Read, User.Read.All, Directory.Read.All, User.ReadWrite.All, Directory.ReadWrite.All |
3838
|Delegated (personal Microsoft account) | Not supported. |
39+
|Application | Not supported. |
40+
41+
### Memberships for other users
42+
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
43+
|Permission type | Permissions (from least to most privileged) |
44+
|:--------------------|:---------------------------------------------------------|
45+
|Delegated (work or school account) | User.Read.All, Directory.Read.All, User.ReadWrite.All, Directory.ReadWrite.All |
46+
|Delegated (personal Microsoft account) | Not supported. |
3947
|Application | User.Read.All, Directory.Read.All, User.ReadWrite.All, Directory.ReadWrite.All |
4048

4149
### Memberships for a group
@@ -80,13 +88,19 @@ Memberships for a directory object.
8088
POST /directoryObjects/{id}/checkMemberObjects
8189
```
8290

83-
Memberships for a user.
91+
Memberships for the signed-in user.
8492
<!-- { "blockType": "ignored" } -->
8593
```http
8694
POST /me/checkMemberObjects
8795
POST /users/{id | userPrincipalName}/checkMemberObjects
8896
```
8997

98+
Memberships for other users.
99+
<!-- { "blockType": "ignored" } -->
100+
```http
101+
POST /users/{id | userPrincipalName}/checkMemberObjects
102+
```
103+
90104
Memberships for a group.
91105
<!-- { "blockType": "ignored" } -->
92106
```http

‎api-reference/beta/api/user-list-memberof.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,12 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424

2525
### Permissions for the signed-in user's direct memberships
2626

27-
<!-- { "blockType": "permissions", "name": "user_list_memberof" } -->
27+
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
2828
[!INCLUDE [permissions-table](../includes/permissions/user-list-memberof-permissions.md)]
2929

3030
### Permissions for another user's direct memberships
3131

32-
<!-- { "blockType": "permissions", "name": "user_list_memberof_2" } -->
32+
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
3333
[!INCLUDE [permissions-table](../includes/permissions/user-list-memberof-2-permissions.md)]
3434

3535
[!INCLUDE [limited-info](../../includes/limited-info.md)]

‎api-reference/beta/api/user-list-transitivememberof.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,12 @@ Choose the permission or permissions marked as least privileged for this API. Us
2424

2525
### Permissions for the signed-in user's memberships
2626

27-
<!-- { "blockType": "permissions", "name": "user_list_transitivememberof" } -->
27+
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
2828
[!INCLUDE [permissions-table](../includes/permissions/user-list-transitivememberof-permissions.md)]
2929

3030
### Permissions for another user's memberships
3131

32-
<!-- { "blockType": "permissions", "name": "user_list_transitivememberof_2" } -->
32+
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
3333
[!INCLUDE [permissions-table](../includes/permissions/user-list-transitivememberof-2-permissions.md)]
3434

3535
[!INCLUDE [limited-info](../../includes/limited-info.md)]

‎api-reference/beta/includes/permissions/user-list-memberof-2-permissions.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ ms.localizationpriority: medium
66

77
|Permission type|Least privileged permissions|Higher privileged permissions|
88
|:---|:---|:---|
9-
|Delegated (work or school account)|User.Read|Directory.Read.All, Directory.ReadWrite.All, GroupMember.Read.All|
9+
|Delegated (work or school account)|User.Read.All|Directory.Read.All, Directory.ReadWrite.All, GroupMember.Read.All|
1010
|Delegated (personal Microsoft account)|Not supported.|Not supported.|
1111
|Application|Directory.Read.All|Directory.ReadWrite.All|
1212

‎api-reference/beta/includes/permissions/user-list-transitivememberof-2-permissions.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ ms.localizationpriority: medium
66

77
|Permission type|Least privileged permissions|Higher privileged permissions|
88
|:---|:---|:---|
9-
|Delegated (work or school account)|User.Read|Directory.Read.All, Directory.ReadWrite.All, Group.Read.All, GroupMember.Read.All, User.Read.All|
9+
|Delegated (work or school account)|User.Read.All|Directory.Read.All, Directory.ReadWrite.All, Group.Read.All, GroupMember.Read.All|
1010
|Delegated (personal Microsoft account)|Not supported.|Not supported.|
1111
|Application|User.Read.All|Directory.Read.All, Directory.ReadWrite.All, Group.Read.All, GroupMember.Read.All|
1212

‎api-reference/v1.0/api/directoryobject-checkmembergroups.md

Lines changed: 16 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,16 @@ You can check up to a maximum of 20 groups per request. This function supports a
2828
|Delegated (personal Microsoft account) | Not supported. |
2929
|Application | User.Read.All and GroupMember.Read.All, User.Read.All and Group.Read.All, Directory.Read.All |
3030

31-
### Group memberships for a user
31+
### Group memberships for the signed-in user
32+
33+
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
34+
|Permission type | Permissions (from least to most privileged) |
35+
|:--------------------|:---------------------------------------------------------|
36+
|Delegated (work or school account) | User.Read, User.ReadBasic.All and GroupMember.Read.All, User.Read.All and GroupMember.Read.All, User.ReadBasic.All and Group.Read.All, User.Read.All and Group.Read.All, Directory.Read.All |
37+
|Delegated (personal Microsoft account) | Not supported. |
38+
|Application | Not supported. |
39+
40+
### Group memberships for other users
3241

3342
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
3443
|Permission type | Permissions (from least to most privileged) |
@@ -69,22 +78,6 @@ You can check up to a maximum of 20 groups per request. This function supports a
6978
<!-- { "blockType": "permissions", "name": "directoryobject_checkmembergroups_6" } -->
7079
[!INCLUDE [permissions-table](../includes/permissions/directoryobject-checkmembergroups-6-permissions.md)]
7180

72-
<!--
73-
74-
Use the follow scenario guidance to help determine which permission types to use:
75-
76-
| Scenario | Permissions to use |
77-
|:-|:-|
78-
| To get group memberships for the signed-in user | Use one of the following sets of permissions: <br/> <li> **User.Read** and **GroupMember.Read.All** <li>**User.Read** and **Group.Read.All** |
79-
| To get group memberships for any user | Use one of the following sets of permissions: <br/> <li> **User.ReadBasic.All** and **GroupMember.Read.All** <li>**User.Read.All** and **GroupMember.Read.All** <li>**User.ReadBasic.All** and **Group.Read.All** <li>**User.Read.All** and **Group.Read.All** |
80-
| To get group memberships for a group | Use either the **GroupMember.Read.All** or **Group.Read.All** permission. |
81-
| To get group memberships for a directory object | Use the **Directory.Read.All** permission. |
82-
83-
<!-- These tables will replace the data in lines 22-36 to help with the tooling that parses permissions tables.
84-
+ Current data is copy-pasted from incorrect files/file names
85-
+ To validate these permissions against lines 32-36
86-
-->
87-
8881
## HTTP request
8982

9083
Group memberships for a directory object (user, group, service principal, or organizational contact).
@@ -93,10 +86,15 @@ Group memberships for a directory object (user, group, service principal, or org
9386
POST /directoryObjects/{id}/checkMemberGroups
9487
```
9588

96-
Group memberships for the signed-in user or other users.
89+
Group memberships for the signed-in user.
9790
<!-- { "blockType": "ignored" } -->
9891
```http
9992
POST /me/checkMemberGroups
93+
```
94+
95+
Group memberships for other users.
96+
<!-- { "blockType": "ignored" } -->
97+
```http
10098
POST /users/{id | userPrincipalName}/checkMemberGroups
10199
```
102100

‎api-reference/v1.0/api/directoryobject-checkmemberobjects.md

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,15 @@ One of the following permissions is required to call this API. To learn more, in
2828
|Delegated (personal Microsoft account) | Not supported. |
2929
|Application | Directory.Read.All |
3030

31-
### Memberships for a user
31+
### Memberships for the signed-in user
32+
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
33+
|Permission type | Permissions (from least to most privileged) |
34+
|:--------------------|:---------------------------------------------------------|
35+
|Delegated (work or school account) | User.Read, User.Read.All, Directory.Read.All, User.ReadWrite.All, Directory.ReadWrite.All |
36+
|Delegated (personal Microsoft account) | Not supported. |
37+
|Application | Not supported. |
38+
39+
### Memberships for other users
3240
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
3341
|Permission type | Permissions (from least to most privileged) |
3442
|:--------------------|:---------------------------------------------------------|
@@ -78,10 +86,15 @@ Memberships for a directory object.
7886
POST /directoryObjects/{id}/checkMemberObjects
7987
```
8088

81-
Memberships for a user.
89+
Memberships for the signed-in user.
8290
<!-- { "blockType": "ignored" } -->
8391
```http
8492
POST /me/checkMemberObjects
93+
```
94+
95+
Memberships for other users.
96+
<!-- { "blockType": "ignored" } -->
97+
```http
8598
POST /users/{id | userPrincipalName}/checkMemberObjects
8699
```
87100

‎api-reference/v1.0/api/user-list-memberof.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,12 @@ Choose the permission or permissions marked as least privileged for this API. Us
2222

2323
### Permissions for the signed-in user's direct memberships
2424

25-
<!-- { "blockType": "permissions", "name": "user_list_memberof" } -->
25+
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
2626
[!INCLUDE [permissions-table](../includes/permissions/user-list-memberof-permissions.md)]
2727

2828
### Permissions for another user's direct memberships
2929

30-
<!-- { "blockType": "permissions", "name": "user_list_memberof_2" } -->
30+
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
3131
[!INCLUDE [permissions-table](../includes/permissions/user-list-memberof-2-permissions.md)]
3232

3333
[!INCLUDE [limited-info](../../includes/limited-info.md)]

‎api-reference/v1.0/api/user-list-transitivememberof.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,12 @@ Choose the permission or permissions marked as least privileged for this API. Us
2222

2323
### Permissions for the signed-in user's memberships
2424

25-
<!-- { "blockType": "permissions", "name": "user_list_transitivememberof" } -->
25+
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
2626
[!INCLUDE [permissions-table](../includes/permissions/user-list-transitivememberof-permissions.md)]
2727

2828
### Permissions for another user's memberships
2929

30-
<!-- { "blockType": "permissions", "name": "user_list_transitivememberof_2" } -->
30+
<!-- { "blockType": "ignored" } // Note: Removing this line will result in the permissions autogeneration tool overwriting the table. -->
3131
[!INCLUDE [permissions-table](../includes/permissions/user-list-transitivememberof-2-permissions.md)]
3232

3333
[!INCLUDE [limited-info](../../includes/limited-info.md)]

0 commit comments

Comments
 (0)