Skip to content

Commit b18003f

Browse files
Learn Build Service GitHub AppLearn Build Service GitHub App
Learn Build Service GitHub App
authored and
Learn Build Service GitHub App
committed
Merging changes synced from https://github.com/microsoftgraph/microsoft-graph-docs (branch live)
2 parents 242c6e1 + e1e1cd3 commit b18003f

54 files changed

Lines changed: 2409 additions & 255 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎api-reference/beta/api/agentidentity-list-inheritedapproleassignments.md‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
---
2+
title: "List inherited app role assignments for an agent identity"
3+
description: "Retrieve the application role assignments (appRoleAssignment objects) that an agent identity inherits from its parent agent identity blueprint principal."
4+
author: "mvoznyarskiy"
5+
ms.date: 04/13/2026
6+
ms.localizationpriority: medium
7+
ms.subservice: "entra-agent-id"
8+
doc_type: apiPageType
9+
---
10+
11+
# List inherited app role assignments for an agent identity
12+
13+
Namespace: microsoft.graph
14+
15+
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
16+
17+
Retrieve the application role assignments ([appRoleAssignment](../resources/approleassignment.md) objects) that an [agent identity](../resources/agentidentity.md) inherits from its parent agent identity blueprint principal. These inherited assignments represent the effective application-level permissions applied at token issuance time.
18+
19+
The inherited collection is strictly read-only. POST, PATCH, and DELETE requests return `405 Method Not Allowed`. To modify the permissions that agent identities inherit, update the parent agent identity blueprint principal's `appRoleAssignments` instead.
20+
21+
Pagination is not supported. All results are returned in a single response. `$top`, `$skip`, and `$skiptoken` are not supported.
22+
23+
Calling this endpoint on a service principal that is not an agent identity returns `404 Not Found`.
24+
25+
## Permissions
26+
27+
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions [only if your app requires it](/graph/permissions-overview#best-practices-for-using-microsoft-graph-permissions). For details about delegated and application permissions, see [Permission types](/graph/permissions-overview#permission-types). To learn more about these permissions, see the [permissions reference](/graph/permissions-reference).
28+
29+
<!-- {
30+
"blockType": "permissions",
31+
"name": "agentidentity-list-inheritedapproleassignments-permissions"
32+
}
33+
-->
34+
[!INCLUDE [permissions-table](../includes/permissions/agentidentity-list-inheritedapproleassignments-permissions.md)]
35+
36+
[!INCLUDE [rbac-approleassignments-apis-read](../includes/rbac-for-apis/rbac-approleassignments-apis-read.md)]
37+
38+
## HTTP request
39+
40+
<!-- {
41+
"blockType": "ignored"
42+
}
43+
-->
44+
``` http
45+
GET /servicePrincipals/microsoft.graph.agentIdentity/{agentIdentity-id}/inheritedAppRoleAssignments
46+
```
47+
48+
## Optional query parameters
49+
50+
This method does not support OData query parameters.
51+
52+
## Request headers
53+
54+
|Name|Description|
55+
|:---|:---|
56+
|Authorization|Bearer {token}. Required. Learn more about [authentication and authorization](/graph/auth/auth-concepts).|
57+
58+
## Request body
59+
60+
Don't supply a request body for this method.
61+
62+
## Response
63+
64+
If successful, this method returns a `200 OK` response code and a collection of [appRoleAssignment](../resources/approleassignment.md) objects in the response body.
65+
66+
## Examples
67+
68+
### Request
69+
70+
The following example shows a request.
71+
<!-- {
72+
"blockType": "request",
73+
"name": "list_inheritedapproleassignment"
74+
}
75+
-->
76+
``` http
77+
GET https://graph.microsoft.com/beta/servicePrincipals/microsoft.graph.agentIdentity/b3f37624-8113-471c-9de3-0234828e3ca2/inheritedAppRoleAssignments
78+
```
79+
80+
81+
### Response
82+
83+
The following example shows the response.
84+
>**Note:** The response object shown here might be shortened for readability.
85+
<!-- {
86+
"blockType": "response",
87+
"truncated": true,
88+
"@odata.type": "Collection(microsoft.graph.appRoleAssignment)"
89+
}
90+
-->
91+
``` http
92+
HTTP/1.1 200 OK
93+
Content-type: application/json
94+
95+
{
96+
"value": [
97+
{
98+
"id": "aabbccdd-1122-3344-5566-778899001122",
99+
"creationTimestamp": "2026-01-15T10:30:00Z",
100+
"appRoleId": "11112222-aaaa-3333-bbbb-4444cccc5555",
101+
"principalDisplayName": "My Agent Identity",
102+
"principalId": "b3f37624-8113-471c-9de3-0234828e3ca2",
103+
"principalType": "ServicePrincipal",
104+
"resourceDisplayName": "Microsoft Graph",
105+
"resourceId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
106+
}
107+
]
108+
}
109+
```
110+

‎api-reference/beta/api/agentidentity-list-inheritedoauth2permissiongrants.md‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
---
2+
title: "List inherited OAuth2 permission grants for an agent identity"
3+
description: "Retrieve the delegated permission grants (oAuth2PermissionGrant objects) that an agent identity inherits from its parent agent identity blueprint principal."
4+
author: "mvoznyarskiy"
5+
ms.date: 04/13/2026
6+
ms.localizationpriority: medium
7+
ms.subservice: "entra-agent-id"
8+
doc_type: apiPageType
9+
---
10+
11+
# List inherited OAuth2 permission grants for an agent identity
12+
13+
Namespace: microsoft.graph
14+
15+
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
16+
17+
Retrieve the delegated permission grants ([oAuth2PermissionGrant](../resources/oauth2permissiongrant.md) objects) that an [agent identity](../resources/agentidentity.md) inherits from its parent agent identity blueprint principal. These inherited grants represent the effective delegated permissions applied at token issuance time.
18+
19+
This endpoint returns only inherited grants where `consentType` is `AllPrincipals` (admin-consented, tenant-wide grants). Grants where `consentType` is `Principal` (user-specific grants) are not returned by this endpoint.
20+
21+
The inherited collection is strictly read-only. POST, PATCH, and DELETE requests return `405 Method Not Allowed`. To modify the permissions that agent identities inherit, update the parent agent identity blueprint principal's `oauth2PermissionGrants` instead.
22+
23+
Pagination is not supported. All results are returned in a single response. `$top`, `$skip`, and `$skiptoken` are not supported.
24+
25+
Calling this endpoint on a service principal that is not an agent identity returns `404 Not Found`.
26+
27+
## Permissions
28+
29+
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions [only if your app requires it](/graph/permissions-overview#best-practices-for-using-microsoft-graph-permissions). For details about delegated and application permissions, see [Permission types](/graph/permissions-overview#permission-types). To learn more about these permissions, see the [permissions reference](/graph/permissions-reference).
30+
31+
<!-- {
32+
"blockType": "permissions",
33+
"name": "agentidentity-list-inheritedoauth2permissiongrants-permissions"
34+
}
35+
-->
36+
[!INCLUDE [permissions-table](../includes/permissions/agentidentity-list-inheritedoauth2permissiongrants-permissions.md)]
37+
38+
[!INCLUDE [rbac-oauth2permissiongrant-serviceprincipal-apis-read](../includes/rbac-for-apis/rbac-oauth2permissiongrant-serviceprincipal-apis-read.md)]
39+
40+
## HTTP request
41+
42+
<!-- {
43+
"blockType": "ignored"
44+
}
45+
-->
46+
``` http
47+
GET /servicePrincipals/microsoft.graph.agentIdentity/{agentIdentity-id}/inheritedOauth2PermissionGrants
48+
```
49+
50+
## Optional query parameters
51+
52+
This method does not support OData query parameters.
53+
54+
## Request headers
55+
56+
|Name|Description|
57+
|:---|:---|
58+
|Authorization|Bearer {token}. Required. Learn more about [authentication and authorization](/graph/auth/auth-concepts).|
59+
60+
## Request body
61+
62+
Don't supply a request body for this method.
63+
64+
## Response
65+
66+
If successful, this method returns a `200 OK` response code and a collection of [oAuth2PermissionGrant](../resources/oauth2permissiongrant.md) objects in the response body.
67+
68+
## Examples
69+
70+
### Request
71+
72+
The following example shows a request.
73+
<!-- {
74+
"blockType": "request",
75+
"name": "list_inheritedoauth2permissiongrant"
76+
}
77+
-->
78+
``` http
79+
GET https://graph.microsoft.com/beta/servicePrincipals/microsoft.graph.agentIdentity/b3f37624-8113-471c-9de3-0234828e3ca2/inheritedOauth2PermissionGrants
80+
```
81+
82+
83+
### Response
84+
85+
The following example shows the response.
86+
>**Note:** The response object shown here might be shortened for readability.
87+
<!-- {
88+
"blockType": "response",
89+
"truncated": true,
90+
"@odata.type": "Collection(microsoft.graph.oAuth2PermissionGrant)"
91+
}
92+
-->
93+
``` http
94+
HTTP/1.1 200 OK
95+
Content-Type: application/json
96+
97+
{
98+
"value": [
99+
{
100+
"id": "abc123def456",
101+
"clientId": "b3f37624-8113-471c-9de3-0234828e3ca2",
102+
"consentType": "AllPrincipals",
103+
"principalId": null,
104+
"resourceId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
105+
"scope": "User.Read Mail.Read",
106+
"startTime": "2026-06-15T00:00:00Z",
107+
"expiryTime": "2027-06-15T00:00:00Z"
108+
}
109+
]
110+
}
111+
```
112+

‎api-reference/beta/api/driveitem-post-permissions.md‎

Lines changed: 74 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ Create a new [permission](../resources/permission.md) object on a [driveItem](..
1919
> [!IMPORTANT]
2020
> This API has the following restrictions:
2121
>
22-
> - For OneDrive for work or school and SharePoint Online, you can only use this method to create a new application permission. If you want to create a new user permission in a **driveItem**, see [invite](./driveitem-invite.md). For more information on application permissions, see [Overview of Selected permissions in OneDrive and SharePoint](/graph/permissions-selected-overview).
22+
> - For OneDrive for work or school and SharePoint Online, you can only use this method to create a new application permission. If you want to create a new user permission in a **driveItem**, see [invite](./driveitem-invite.md). For more information on application permissions, see [Overview of selected permissions in OneDrive and SharePoint](/graph/permissions-selected-overview).
2323
> - For SharePoint Embedded, you can only use this method to create a new [sharePointGroup](../resources/sharepointgroup.md) permission with app-only access. You can't create a permission on the root item of a container.
2424
2525
[!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
@@ -57,8 +57,8 @@ In the request body, supply a JSON representation of the [permission](../resourc
5757

5858
> [!IMPORTANT]
5959
>
60-
> - This API only accepts `grantedToV2` as input for the **permission** object. Other properties such as `grantedToIdentitiesV2` or the deprecated `grantedTo` and `grantedToIdentities` are not accepted.
61-
> - For SharePoint Embedded, when creating a new [sharePointGroup](../resources/sharepointgroup.md) permission, the request body must include both the `id` and `displayName` of the **sharePointGroup** referenced in the `grantedToV2.siteGroup` property. See [Example 2](#example-2-add-a-sharepoint-group-permission-to-a-driveitem-in-a-sharepoint-embedded-container).
60+
> - This API only accepts **grantedToV2** as input for the **permission** object. Other properties such as **grantedToIdentitiesV2** or the deprecated **grantedTo** and **grantedToIdentities** aren't accepted.
61+
> - For SharePoint Embedded, when you create a new [sharePointGroup](../resources/sharepointgroup.md) permission, we recommend that you reference the **sharePointGroup** using the **grantedToV2.sharePointGroup.id** property in the request body. This **id** should map to the **id** of the **sharePointGroup** property. For more information, see [Example 2](#example-2-add-a-sharepoint-group-permission-to-a-driveitem-in-a-sharepoint-embedded-container-using-its-id). We don't recommend that you reference a **sharePointGroup** using its **principalId** because the **principalId** is only unique within the site, unlike the **id** of the **sharePointGroup**, which is globally unique. In that case, the request body must include both **id** and **displayName** in the **grantedToV2.siteGroup** property. The **id** must point to the **principalId** of the **sharePointGroup** and the **displayName** must point to the **title** of the **sharePointGroup**. For more information, see [Example 3](#example-3-add-a-sharepoint-group-permission-to-a-driveitem-in-a-sharepoint-embedded-container-using-the-principalid).
6262
6363
## Response
6464

@@ -159,9 +159,78 @@ Content-Type: application/json
159159
}
160160
```
161161

162-
### Example 2: Add a SharePoint group permission to a driveItem in a SharePoint Embedded container
162+
### Example 2: Add a SharePoint group permission to a driveItem in a SharePoint Embedded container using its ID
163163

164-
The following example shows how to add a `write` [permission](../resources/permission.md) for the `Internal Collaborators` [sharePointGroup](../resources/sharepointgroup.md) on a [driveItem](../resources/driveitem.md) identified by `01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU` in a SharePoint Embedded [fileStorageContainer](../resources/filestoragecontainer.md) identified by `b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop`.
164+
The following example shows how to add a `write` [permission](../resources/permission.md) for the `internal collaborators` [sharePointGroup](../resources/sharepointgroup.md) on a [driveItem](../resources/driveitem.md) identified by `01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU` in a SharePoint Embedded [fileStorageContainer](../resources/filestoragecontainer.md) identified by `b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop`.
165+
166+
#### Request
167+
168+
The following example shows a request.
169+
170+
<!-- {
171+
"blockType": "request",
172+
"name": "driveitem-post-permissions-3",
173+
"scopes": "filestoragecontainer.selected",
174+
"target": "action"
175+
} -->
176+
```http
177+
POST https://graph.microsoft.com/beta/drives/b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop/items/01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU/permissions
178+
Content-Type: application/json
179+
180+
{
181+
"grantedToV2": {
182+
"sharePointGroup": {
183+
"id": "ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0"
184+
}
185+
},
186+
"roles": ["write"]
187+
}
188+
```
189+
190+
---
191+
192+
#### Response
193+
194+
The following example shows the response.
195+
196+
<!-- {
197+
"blockType": "response",
198+
"truncated": true,
199+
"@odata.type": "microsoft.graph.permission"
200+
}
201+
-->
202+
``` http
203+
HTTP/1.1 201 Created
204+
Content-Type: application/json
205+
206+
{
207+
"id": "aTowaS50fG1zLnNwLmV4dHwxMEBkOWNlMGZjMS02MWQ4LTRhMmUtYjVkMy0xODc3MGRmMDY3MmM=",
208+
"roles": [
209+
"write"
210+
],
211+
"grantedToV2": {
212+
"sharePointGroup": {
213+
"id": "ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0",
214+
"principalId": "10",
215+
"title": "Internal Collaborators"
216+
},
217+
"siteGroup": {
218+
"id": "10",
219+
"displayName": "Internal Collaborators"
220+
}
221+
},
222+
"grantedTo": {
223+
"siteGroup": {
224+
"id": "10",
225+
"displayName": "Internal Collaborators"
226+
}
227+
}
228+
}
229+
```
230+
231+
### Example 3: Add a SharePoint group permission to a driveItem in a SharePoint Embedded container using the principalId
232+
233+
The following example shows how to add a `write` [permission](../resources/permission.md) for the `internal collaborators` [sharePointGroup](../resources/sharepointgroup.md) on a [driveItem](../resources/driveitem.md) identified by `01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU` in a SharePoint Embedded [fileStorageContainer](../resources/filestoragecontainer.md) identified by `b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop`.
165234

166235
#### Request
167236

‎api-reference/beta/api/filestoragecontainer-delete-sharepointgroups.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: "Delete sharePointGroup"
3-
description: "Delete a sharePointGroup object."
3+
description: "Delete a sharePointGroup object that is local to a fileStorageContainer."
44
author: "tmarwendo-microsoft"
55
ms.localizationpriority: medium
66
ms.subservice: "onedrive"
@@ -56,7 +56,7 @@ If successful, this method returns a `204 No Content` response code.
5656

5757
### Example 1: Delete a SharePoint group
5858

59-
The following example deletes a **sharePointGroup** identified by the ID `10` from the **fileStorageContainer** identified by the container ID `b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z`.
59+
The following example deletes a **sharePointGroup** identified by the ID `ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0` from the **fileStorageContainer** identified by the container ID `b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z`.
6060

6161
#### Request
6262

@@ -68,7 +68,7 @@ The following example shows a request.
6868
"name": "delete_sharepointgroup"
6969
}-->
7070
```http
71-
DELETE https://graph.microsoft.com/beta/storage/fileStorage/containers/b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z/sharePointGroups/10
71+
DELETE https://graph.microsoft.com/beta/storage/fileStorage/containers/b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z/sharePointGroups/ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0
7272
```
7373

7474
# [C#](#tab/csharp)
@@ -112,7 +112,7 @@ HTTP/1.1 204 No Content
112112

113113
### Example 2: Attempt to delete a SharePoint group that doesn't exist
114114

115-
The following example attempts to delete a **sharePointGroup** identified by the ID `11` from the **fileStorageContainer** identified by the container ID `b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z`; however, the group doesn't exist in the container.
115+
The following example attempts to delete a **sharePointGroup** identified by the ID `ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE1` from the **fileStorageContainer** identified by the container ID `b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z`; however, the group doesn't exist in the container.
116116

117117
#### Request
118118

@@ -122,7 +122,7 @@ The following example attempts to delete a **sharePointGroup** identified by the
122122
"name": "delete_nonexisting_sharepointgroup"
123123
}-->
124124
```http
125-
DELETE https://graph.microsoft.com/beta/storage/fileStorage/containers/b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z/sharePointGroups/11
125+
DELETE https://graph.microsoft.com/beta/storage/fileStorage/containers/b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z/sharePointGroups/ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE1
126126
```
127127

128128
# [C#](#tab/csharp)

0 commit comments

Comments
 (0)