Skip to content

spo list roleassignment add not working as expected #6179

@louderthanloud123

Description

@louderthanloud123

Agreed fix

Since Microsoft Entra groups were never actually supported, we agreed that first of all, we should clarify in the docs that the option groupName is only for SharePoint groups, and not Microsoft Entra groups. We should do this for all roleassignment commands (listitem, list, web, file, folder).


Original post:

Priority

(Medium) I'm annoyed but I'll live

Description

I'm trying to programmatically create a lot of document libraries and associated permissions based on a CSV. I've got most of the configuration I need working, however I'm struggling the assignment of permissions.
I've successfully broken inheritance, and now I want to assign permission based on Entra Security groups (I could live with 365 Group if I have to).

I'm using the command spo list roleassignment add --webUrl https:\mysite --listTitle "Team" --GroupName "siteSecGroup" -roledefinitionName "Contribute"

This gives me the error Error: Group cannot be found

I've tried using --principalId and supplying the object ID, but that ones gives me the error: Error: Specified principalid 12345-1234-1234 is not a number

The documentation for these commands explicitly says that I can use Entra groups, so why does it not work?

If I create a Sharepoint group first (m365 spo group add) I can add that group, but that doesn't match up with the EntraID group.

The same errors persist whether it's a security or m365 group. I can assign either group manually through the document settings menu.

Am i doing something wrong? I'd really like this working because assigning permissions to 100 document libraries is going to be extremely tedious!

Thank you!

Steps to reproduce

Create entra security group
Create document library

run the command: m365spo list roleassignment add --webUrl https:\mysite --listTitle "Team" --GroupName "siteSecGroup" -roledefinitionName "Contribute"

Expected results

Group to be added to library permissions list

Actual results

--groupName produces the error: Group cannot be found
--principalId produces the error: Specified principalId is not a number

Diagnostics

Request:
{
"url": "https://tenantname.sharepoint.com/sites/sitename//_api/web/roledefinitions",
"method": "get",
"headers": {
"Accept": "application/json;odata.metadata=none",
"user-agent": "NONISV|SharePointPnP|CLIMicrosoft365/7.10.0",
"accept-encoding": "gzip, deflate",
"X-ClientService-ClientTag": "M365CLI:7.10.0",
"odata-version": "4.0",
"authorization": "Bearer ACCESSTOKEN"
},
"responseType": "json",
"decompress": true
}
Response:
{
"url": "https://tenantname.sharepoint.com/sites/sitename//_api/web/roledefinitions",
"status": 200,
"statusText": "OK",
"headers": {
"cache-control": "private, max-age=0",
"transfer-encoding": "chunked",
"content-type": "application/json;odata.metadata=none;odata.streaming=true;IEEE754Compatible=false;charset=utf-8",
"expires": "Wed, 10 Jul 2024 11:22:25 GMT",
"last-modified": "Thu, 25 Jul 2024 11:22:25 GMT",
"vary": "Origin,Accept-Encoding",
"p3p": "CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"",
"x-networkstatistics": "0,525568,0,0,13920,0,32822,4",
"x-sharepointhealthscore": "2",
"x-sp-serverstate": "ReadOnly=0",
"odata-version": "4.0",
"spclientservicerequestduration": "18",
"sprequestduration": "19",
"x-aspnet-version": "4.0.30319",
"x-databoundary": "EU",
"x-1dscollectorurl": "https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/",
"x-ariacollectorurl": "https://eu-mobile.events.data.microsoft.com/Collector/3.0",
"sprequestguid": "d9bc3fa1-20a4-9000-825a-7e8ffe2d62ce",
"request-id": "d9bc3fa1-20a4-9000-825a-7e8ffe2d62ce",
"ms-cv": "oT+82aQgAJCCWn6P/i1izg.0",
"strict-transport-security": "max-age=31536000",
"x-frame-options": "SAMEORIGIN",
"content-security-policy": "frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com teams.cloud.microsoft *.office365.com goals.cloud.microsoft *.powerapps.com *.powerbi.com *.yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft *.officeapps.live.com *.office.com *.microsoft365.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com;",
"x-powered-by": "ASP.NET",
"microsoftsharepointteamservices": "16.0.0.25110",
"x-content-type-options": "nosniff",
"x-ms-invokeapp": "1; RequireReadOnly",
"x-cache": "CONFIG_NOCACHE",
"x-msedge-ref": "Ref A: AEF71239D46E469888B3BCF5ADE3F7F7 Ref B: LON21EDGE2416 Ref C: 2024-07-25T11:22:25Z",
"date": "Thu, 25 Jul 2024 11:22:25 GMT"
},
"data": {
"value": [
{
"BasePermissions": {
"High": 2147483647,
"Low": 4294967295
},
"Description": "Has full control.",
"Hidden": false,
"Id": 1073741829,
"Name": "Full Control",
"Order": 1,
"RoleTypeKind": 5
},
{
"BasePermissions": {
"High": 432,
"Low": 1012866047
},
"Description": "Can view, add, update, delete, approve, and customize.",
"Hidden": false,
"Id": 1073741828,
"Name": "Design",
"Order": 32,
"RoleTypeKind": 4
},
{
"BasePermissions": {
"High": 432,
"Low": 1011030767
},
"Description": "Can add, edit and delete lists; can view, add, update and delete list items and documents.",
"Hidden": false,
"Id": 1073741830,
"Name": "Edit",
"Order": 48,
"RoleTypeKind": 6
},
{
"BasePermissions": {
"High": 432,
"Low": 1011028719
},
"Description": "Can view, add, update, and delete list items and documents.",
"Hidden": false,
"Id": 1073741827,
"Name": "Contribute",
"Order": 64,
"RoleTypeKind": 3
},
{
"BasePermissions": {
"High": 176,
"Low": 138612833
},
"Description": "Can view pages and list items and download documents.",
"Hidden": false,
"Id": 1073741826,
"Name": "Read",
"Order": 128,
"RoleTypeKind": 2
},
{
"BasePermissions": {
"High": 48,
"Low": 134287360
},
"Description": "Can view specific lists, document libraries, list items, folders, or documents when given permissions.",
"Hidden": true,
"Id": 1073741825,
"Name": "Limited Access",
"Order": 160,
"RoleTypeKind": 1
}
]
}
}
Retrieving the group by name SP_IHDemo_M365Test
Existing access token ACCESSTOKEN still valid. Returning...
Request:
{
"url": "https://tenantname.sharepoint.com/sites/sitename//_api/web/sitegroups/GetByName('SP_IHDemo_M365Test')",
"method": "get",
"headers": {
"Accept": "application/json;odata=nometadata",
"user-agent": "NONISV|SharePointPnP|CLIMicrosoft365/7.10.0",
"accept-encoding": "gzip, deflate",
"X-ClientService-ClientTag": "M365CLI:7.10.0",
"authorization": "Bearer ACCESSTOKEN"
},
"responseType": "json",
"decompress": true
}
Request error:
{
"url": "https://tenantname.sharepoint.com/sites/sitename//_api/web/sitegroups/GetByName('SP_IHDemo_M365Test')",
"status": 404,
"statusText": "Not Found",
"headers": {
"cache-control": "private, max-age=0",
"transfer-encoding": "chunked",
"content-type": "application/json;odata=nometadata;streaming=true;charset=utf-8",
"expires": "Wed, 10 Jul 2024 11:22:25 GMT",
"last-modified": "Thu, 25 Jul 2024 11:22:25 GMT",
"vary": "Origin",
"p3p": "CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"",
"x-networkstatistics": "0,525568,0,0,13990,0,36271,4",
"x-sharepointhealthscore": "0",
"x-sp-serverstate": "ReadOnly=0",
"dataserviceversion": "3.0",
"spclientservicerequestduration": "13",
"sprequestduration": "14",
"x-aspnet-version": "4.0.30319",
"x-databoundary": "EU",
"x-1dscollectorurl": "https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/",
"x-ariacollectorurl": "https://eu-mobile.events.data.microsoft.com/Collector/3.0",
"sprequestguid": "d9bc3fa1-50a9-9000-825a-72699d0ef07b",
"request-id": "d9bc3fa1-50a9-9000-825a-72699d0ef07b",
"ms-cv": "oT+82alQAJCCWnJpnQ7wew.0",
"strict-transport-security": "max-age=31536000",
"x-frame-options": "SAMEORIGIN",
"content-security-policy": "frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com teams.cloud.microsoft *.office365.com goals.cloud.microsoft *.powerapps.com *.powerbi.com *.yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft *.officeapps.live.com *.office.com *.microsoft365.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com;",
"x-powered-by": "ASP.NET",
"microsoftsharepointteamservices": "16.0.0.25110",
"x-content-type-options": "nosniff",
"x-ms-invokeapp": "1; RequireReadOnly",
"x-cache": "CONFIG_NOCACHE",
"x-msedge-ref": "Ref A: 124F0DC0ABD24B6F8C31C051B52C097C Ref B: LON21EDGE2416 Ref C: 2024-07-25T11:22:25Z",
"date": "Thu, 25 Jul 2024 11:22:25 GMT"
},
"error": {
"odata.error": {
"code": "-2146232832, Microsoft.SharePoint.SPException",
"message": {
"lang": "en-US",
"value": "Group cannot be found."
}
}
}
}

Timings:
api: 865.9449ms
core: 16.1292ms
command: 908.4889ms
options: 0.298ms
total: 927.9853ms
validation: 0.4512ms
Error: Group cannot be found.

CLI for Microsoft 365 version

v7.10.0

nodejs version

20.15.1

Operating system (environment)

Windows

Shell

PowerShell

cli doctor

{
"os": {
"platform": "win32",
"version": "Windows 10 Enterprise",
"release": "10.0.19045"
},
"cliVersion": "7.10.0",
"nodeVersion": "v20.15.1",
"cliAadAppId": "OBSCURED",
"cliAadAppTenant": "common",
"authMode": "DeviceCode",
"cliEnvironment": "",
"cliConfig": {},
"roles": [],
"scopes": {
"https://graph.microsoft.com": [
"AllSites.FullControl",
"AppCatalog.ReadWrite.All",
"AuditLog.Read.All",
"Bookings.Read.All",
"Calendars.Read",
"ChannelMember.ReadWrite.All",
"ChannelMessage.Read.All",
"ChannelMessage.Send",
"ChannelSettings.ReadWrite.All",
"Chat.Read",
"Chat.ReadWrite",
"Directory.AccessAsUser.All",
"Directory.ReadWrite.All",
"ExternalConnection.ReadWrite.All",
"ExternalItem.ReadWrite.All",
"Group.ReadWrite.All",
"IdentityProvider.ReadWrite.All",
"InformationProtectionPolicy.Read",
"Mail.Read.Shared",
"Mail.ReadWrite",
"Mail.Send",
"Notes.Read.All",
"OnlineMeetingArtifact.Read.All",
"OnlineMeetings.ReadWrite",
"OnlineMeetingTranscript.Read.All",
"PeopleSettings.ReadWrite.All",
"Place.Read.All",
"Policy.Read.All",
"RecordsManagement.ReadWrite.All",
"Reports.Read.All",
"RoleAssignmentSchedule.ReadWrite.Directory",
"RoleEligibilitySchedule.Read.Directory",
"SecurityEvents.Read.All",
"ServiceHealth.Read.All",
"ServiceMessage.Read.All",
"ServiceMessageViewpoint.Write",
"Sites.Read.All",
"Tasks.ReadWrite",
"Team.Create",
"TeamMember.ReadWrite.All",
"TeamsAppInstallation.ReadWriteForUser",
"TeamSettings.ReadWrite.All",
"TeamsTab.ReadWrite.All",
"TermStore.ReadWrite.All",
"User.Invite.All",
"User.ReadWrite.All",
"profile",
"openid",
"email"
],
"https://tenantname.sharepoint.com": [
"AllSites.FullControl",
"AppCatalog.ReadWrite.All",
"AuditLog.Read.All",
"Bookings.Read.All",
"Calendars.Read",
"ChannelMember.ReadWrite.All",
"ChannelMessage.Read.All",
"ChannelMessage.Send",
"ChannelSettings.ReadWrite.All",
"Chat.Read",
"Chat.ReadWrite",
"Directory.AccessAsUser.All",
"Directory.ReadWrite.All",
"ExternalConnection.ReadWrite.All",
"ExternalItem.ReadWrite.All",
"Group.ReadWrite.All",
"IdentityProvider.ReadWrite.All",
"InformationProtectionPolicy.Read",
"Mail.Read.Shared",
"Mail.ReadWrite",
"Mail.Send",
"Notes.Read.All",
"OnlineMeetingArtifact.Read.All",
"OnlineMeetings.ReadWrite",
"OnlineMeetingTranscript.Read.All",
"PeopleSettings.ReadWrite.All",
"Place.Read.All",
"Policy.Read.All",
"RecordsManagement.ReadWrite.All",
"Reports.Read.All",
"RoleAssignmentSchedule.ReadWrite.Directory",
"RoleEligibilitySchedule.Read.Directory",
"SecurityEvents.Read.All",
"ServiceHealth.Read.All",
"ServiceMessage.Read.All",
"ServiceMessageViewpoint.Write",
"Sites.Read.All",
"Tasks.ReadWrite",
"Team.Create",
"TeamMember.ReadWrite.All",
"TeamsAppInstallation.ReadWriteForUser",
"TeamSettings.ReadWrite.All",
"TeamsTab.ReadWrite.All",
"TermStore.ReadWrite.All",
"User.Invite.All",
"User.ReadWrite.All"
]
}
}

Additional Info

No response

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions