Skip to content

Commit e1e1cd3

Browse files
DanipocketDanipocket
authored
Merge pull request #28786 from microsoftgraph/main
merge to publish.
2 parents 8c96576 + 955224a commit e1e1cd3

54 files changed

Lines changed: 2409 additions & 255 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎api-reference/beta/api/agentidentity-list-inheritedapproleassignments.md‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
---
2+
title: "List inherited app role assignments for an agent identity"
3+
description: "Retrieve the application role assignments (appRoleAssignment objects) that an agent identity inherits from its parent agent identity blueprint principal."
4+
author: "mvoznyarskiy"
5+
ms.date: 04/13/2026
6+
ms.localizationpriority: medium
7+
ms.subservice: "entra-agent-id"
8+
doc_type: apiPageType
9+
---
10+
11+
# List inherited app role assignments for an agent identity
12+
13+
Namespace: microsoft.graph
14+
15+
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
16+
17+
Retrieve the application role assignments ([appRoleAssignment](../resources/approleassignment.md) objects) that an [agent identity](../resources/agentidentity.md) inherits from its parent agent identity blueprint principal. These inherited assignments represent the effective application-level permissions applied at token issuance time.
18+
19+
The inherited collection is strictly read-only. POST, PATCH, and DELETE requests return `405 Method Not Allowed`. To modify the permissions that agent identities inherit, update the parent agent identity blueprint principal's `appRoleAssignments` instead.
20+
21+
Pagination is not supported. All results are returned in a single response. `$top`, `$skip`, and `$skiptoken` are not supported.
22+
23+
Calling this endpoint on a service principal that is not an agent identity returns `404 Not Found`.
24+
25+
## Permissions
26+
27+
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions [only if your app requires it](/graph/permissions-overview#best-practices-for-using-microsoft-graph-permissions). For details about delegated and application permissions, see [Permission types](/graph/permissions-overview#permission-types). To learn more about these permissions, see the [permissions reference](/graph/permissions-reference).
28+
29+
<!-- {
30+
"blockType": "permissions",
31+
"name": "agentidentity-list-inheritedapproleassignments-permissions"
32+
}
33+
-->
34+
[!INCLUDE [permissions-table](../includes/permissions/agentidentity-list-inheritedapproleassignments-permissions.md)]
35+
36+
[!INCLUDE [rbac-approleassignments-apis-read](../includes/rbac-for-apis/rbac-approleassignments-apis-read.md)]
37+
38+
## HTTP request
39+
40+
<!-- {
41+
"blockType": "ignored"
42+
}
43+
-->
44+
``` http
45+
GET /servicePrincipals/microsoft.graph.agentIdentity/{agentIdentity-id}/inheritedAppRoleAssignments
46+
```
47+
48+
## Optional query parameters
49+
50+
This method does not support OData query parameters.
51+
52+
## Request headers
53+
54+
|Name|Description|
55+
|:---|:---|
56+
|Authorization|Bearer {token}. Required. Learn more about [authentication and authorization](/graph/auth/auth-concepts).|
57+
58+
## Request body
59+
60+
Don't supply a request body for this method.
61+
62+
## Response
63+
64+
If successful, this method returns a `200 OK` response code and a collection of [appRoleAssignment](../resources/approleassignment.md) objects in the response body.
65+
66+
## Examples
67+
68+
### Request
69+
70+
The following example shows a request.
71+
<!-- {
72+
"blockType": "request",
73+
"name": "list_inheritedapproleassignment"
74+
}
75+
-->
76+
``` http
77+
GET https://graph.microsoft.com/beta/servicePrincipals/microsoft.graph.agentIdentity/b3f37624-8113-471c-9de3-0234828e3ca2/inheritedAppRoleAssignments
78+
```
79+
80+
81+
### Response
82+
83+
The following example shows the response.
84+
>**Note:** The response object shown here might be shortened for readability.
85+
<!-- {
86+
"blockType": "response",
87+
"truncated": true,
88+
"@odata.type": "Collection(microsoft.graph.appRoleAssignment)"
89+
}
90+
-->
91+
``` http
92+
HTTP/1.1 200 OK
93+
Content-type: application/json
94+
95+
{
96+
"value": [
97+
{
98+
"id": "aabbccdd-1122-3344-5566-778899001122",
99+
"creationTimestamp": "2026-01-15T10:30:00Z",
100+
"appRoleId": "11112222-aaaa-3333-bbbb-4444cccc5555",
101+
"principalDisplayName": "My Agent Identity",
102+
"principalId": "b3f37624-8113-471c-9de3-0234828e3ca2",
103+
"principalType": "ServicePrincipal",
104+
"resourceDisplayName": "Microsoft Graph",
105+
"resourceId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
106+
}
107+
]
108+
}
109+
```
110+

‎api-reference/beta/api/agentidentity-list-inheritedoauth2permissiongrants.md‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
---
2+
title: "List inherited OAuth2 permission grants for an agent identity"
3+
description: "Retrieve the delegated permission grants (oAuth2PermissionGrant objects) that an agent identity inherits from its parent agent identity blueprint principal."
4+
author: "mvoznyarskiy"
5+
ms.date: 04/13/2026
6+
ms.localizationpriority: medium
7+
ms.subservice: "entra-agent-id"
8+
doc_type: apiPageType
9+
---
10+
11+
# List inherited OAuth2 permission grants for an agent identity
12+
13+
Namespace: microsoft.graph
14+
15+
[!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
16+
17+
Retrieve the delegated permission grants ([oAuth2PermissionGrant](../resources/oauth2permissiongrant.md) objects) that an [agent identity](../resources/agentidentity.md) inherits from its parent agent identity blueprint principal. These inherited grants represent the effective delegated permissions applied at token issuance time.
18+
19+
This endpoint returns only inherited grants where `consentType` is `AllPrincipals` (admin-consented, tenant-wide grants). Grants where `consentType` is `Principal` (user-specific grants) are not returned by this endpoint.
20+
21+
The inherited collection is strictly read-only. POST, PATCH, and DELETE requests return `405 Method Not Allowed`. To modify the permissions that agent identities inherit, update the parent agent identity blueprint principal's `oauth2PermissionGrants` instead.
22+
23+
Pagination is not supported. All results are returned in a single response. `$top`, `$skip`, and `$skiptoken` are not supported.
24+
25+
Calling this endpoint on a service principal that is not an agent identity returns `404 Not Found`.
26+
27+
## Permissions
28+
29+
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions [only if your app requires it](/graph/permissions-overview#best-practices-for-using-microsoft-graph-permissions). For details about delegated and application permissions, see [Permission types](/graph/permissions-overview#permission-types). To learn more about these permissions, see the [permissions reference](/graph/permissions-reference).
30+
31+
<!-- {
32+
"blockType": "permissions",
33+
"name": "agentidentity-list-inheritedoauth2permissiongrants-permissions"
34+
}
35+
-->
36+
[!INCLUDE [permissions-table](../includes/permissions/agentidentity-list-inheritedoauth2permissiongrants-permissions.md)]
37+
38+
[!INCLUDE [rbac-oauth2permissiongrant-serviceprincipal-apis-read](../includes/rbac-for-apis/rbac-oauth2permissiongrant-serviceprincipal-apis-read.md)]
39+
40+
## HTTP request
41+
42+
<!-- {
43+
"blockType": "ignored"
44+
}
45+
-->
46+
``` http
47+
GET /servicePrincipals/microsoft.graph.agentIdentity/{agentIdentity-id}/inheritedOauth2PermissionGrants
48+
```
49+
50+
## Optional query parameters
51+
52+
This method does not support OData query parameters.
53+
54+
## Request headers
55+
56+
|Name|Description|
57+
|:---|:---|
58+
|Authorization|Bearer {token}. Required. Learn more about [authentication and authorization](/graph/auth/auth-concepts).|
59+
60+
## Request body
61+
62+
Don't supply a request body for this method.
63+
64+
## Response
65+
66+
If successful, this method returns a `200 OK` response code and a collection of [oAuth2PermissionGrant](../resources/oauth2permissiongrant.md) objects in the response body.
67+
68+
## Examples
69+
70+
### Request
71+
72+
The following example shows a request.
73+
<!-- {
74+
"blockType": "request",
75+
"name": "list_inheritedoauth2permissiongrant"
76+
}
77+
-->
78+
``` http
79+
GET https://graph.microsoft.com/beta/servicePrincipals/microsoft.graph.agentIdentity/b3f37624-8113-471c-9de3-0234828e3ca2/inheritedOauth2PermissionGrants
80+
```
81+
82+
83+
### Response
84+
85+
The following example shows the response.
86+
>**Note:** The response object shown here might be shortened for readability.
87+
<!-- {
88+
"blockType": "response",
89+
"truncated": true,
90+
"@odata.type": "Collection(microsoft.graph.oAuth2PermissionGrant)"
91+
}
92+
-->
93+
``` http
94+
HTTP/1.1 200 OK
95+
Content-Type: application/json
96+
97+
{
98+
"value": [
99+
{
100+
"id": "abc123def456",
101+
"clientId": "b3f37624-8113-471c-9de3-0234828e3ca2",
102+
"consentType": "AllPrincipals",
103+
"principalId": null,
104+
"resourceId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
105+
"scope": "User.Read Mail.Read",
106+
"startTime": "2026-06-15T00:00:00Z",
107+
"expiryTime": "2027-06-15T00:00:00Z"
108+
}
109+
]
110+
}
111+
```
112+

‎api-reference/beta/api/driveitem-post-permissions.md‎

Lines changed: 74 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ Create a new [permission](../resources/permission.md) object on a [driveItem](..
1919
> [!IMPORTANT]
2020
> This API has the following restrictions:
2121
>
22-
> - For OneDrive for work or school and SharePoint Online, you can only use this method to create a new application permission. If you want to create a new user permission in a **driveItem**, see [invite](./driveitem-invite.md). For more information on application permissions, see [Overview of Selected permissions in OneDrive and SharePoint](/graph/permissions-selected-overview).
22+
> - For OneDrive for work or school and SharePoint Online, you can only use this method to create a new application permission. If you want to create a new user permission in a **driveItem**, see [invite](./driveitem-invite.md). For more information on application permissions, see [Overview of selected permissions in OneDrive and SharePoint](/graph/permissions-selected-overview).
2323
> - For SharePoint Embedded, you can only use this method to create a new [sharePointGroup](../resources/sharepointgroup.md) permission with app-only access. You can't create a permission on the root item of a container.
2424
2525
[!INCLUDE [national-cloud-support](../../includes/all-clouds.md)]
@@ -57,8 +57,8 @@ In the request body, supply a JSON representation of the [permission](../resourc
5757

5858
> [!IMPORTANT]
5959
>
60-
> - This API only accepts `grantedToV2` as input for the **permission** object. Other properties such as `grantedToIdentitiesV2` or the deprecated `grantedTo` and `grantedToIdentities` are not accepted.
61-
> - For SharePoint Embedded, when creating a new [sharePointGroup](../resources/sharepointgroup.md) permission, the request body must include both the `id` and `displayName` of the **sharePointGroup** referenced in the `grantedToV2.siteGroup` property. See [Example 2](#example-2-add-a-sharepoint-group-permission-to-a-driveitem-in-a-sharepoint-embedded-container).
60+
> - This API only accepts **grantedToV2** as input for the **permission** object. Other properties such as **grantedToIdentitiesV2** or the deprecated **grantedTo** and **grantedToIdentities** aren't accepted.
61+
> - For SharePoint Embedded, when you create a new [sharePointGroup](../resources/sharepointgroup.md) permission, we recommend that you reference the **sharePointGroup** using the **grantedToV2.sharePointGroup.id** property in the request body. This **id** should map to the **id** of the **sharePointGroup** property. For more information, see [Example 2](#example-2-add-a-sharepoint-group-permission-to-a-driveitem-in-a-sharepoint-embedded-container-using-its-id). We don't recommend that you reference a **sharePointGroup** using its **principalId** because the **principalId** is only unique within the site, unlike the **id** of the **sharePointGroup**, which is globally unique. In that case, the request body must include both **id** and **displayName** in the **grantedToV2.siteGroup** property. The **id** must point to the **principalId** of the **sharePointGroup** and the **displayName** must point to the **title** of the **sharePointGroup**. For more information, see [Example 3](#example-3-add-a-sharepoint-group-permission-to-a-driveitem-in-a-sharepoint-embedded-container-using-the-principalid).
6262
6363
## Response
6464

@@ -159,9 +159,78 @@ Content-Type: application/json
159159
}
160160
```
161161

162-
### Example 2: Add a SharePoint group permission to a driveItem in a SharePoint Embedded container
162+
### Example 2: Add a SharePoint group permission to a driveItem in a SharePoint Embedded container using its ID
163163

164-
The following example shows how to add a `write` [permission](../resources/permission.md) for the `Internal Collaborators` [sharePointGroup](../resources/sharepointgroup.md) on a [driveItem](../resources/driveitem.md) identified by `01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU` in a SharePoint Embedded [fileStorageContainer](../resources/filestoragecontainer.md) identified by `b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop`.
164+
The following example shows how to add a `write` [permission](../resources/permission.md) for the `internal collaborators` [sharePointGroup](../resources/sharepointgroup.md) on a [driveItem](../resources/driveitem.md) identified by `01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU` in a SharePoint Embedded [fileStorageContainer](../resources/filestoragecontainer.md) identified by `b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop`.
165+
166+
#### Request
167+
168+
The following example shows a request.
169+
170+
<!-- {
171+
"blockType": "request",
172+
"name": "driveitem-post-permissions-3",
173+
"scopes": "filestoragecontainer.selected",
174+
"target": "action"
175+
} -->
176+
```http
177+
POST https://graph.microsoft.com/beta/drives/b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop/items/01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU/permissions
178+
Content-Type: application/json
179+
180+
{
181+
"grantedToV2": {
182+
"sharePointGroup": {
183+
"id": "ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0"
184+
}
185+
},
186+
"roles": ["write"]
187+
}
188+
```
189+
190+
---
191+
192+
#### Response
193+
194+
The following example shows the response.
195+
196+
<!-- {
197+
"blockType": "response",
198+
"truncated": true,
199+
"@odata.type": "microsoft.graph.permission"
200+
}
201+
-->
202+
``` http
203+
HTTP/1.1 201 Created
204+
Content-Type: application/json
205+
206+
{
207+
"id": "aTowaS50fG1zLnNwLmV4dHwxMEBkOWNlMGZjMS02MWQ4LTRhMmUtYjVkMy0xODc3MGRmMDY3MmM=",
208+
"roles": [
209+
"write"
210+
],
211+
"grantedToV2": {
212+
"sharePointGroup": {
213+
"id": "ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0",
214+
"principalId": "10",
215+
"title": "Internal Collaborators"
216+
},
217+
"siteGroup": {
218+
"id": "10",
219+
"displayName": "Internal Collaborators"
220+
}
221+
},
222+
"grantedTo": {
223+
"siteGroup": {
224+
"id": "10",
225+
"displayName": "Internal Collaborators"
226+
}
227+
}
228+
}
229+
```
230+
231+
### Example 3: Add a SharePoint group permission to a driveItem in a SharePoint Embedded container using the principalId
232+
233+
The following example shows how to add a `write` [permission](../resources/permission.md) for the `internal collaborators` [sharePointGroup](../resources/sharepointgroup.md) on a [driveItem](../resources/driveitem.md) identified by `01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU` in a SharePoint Embedded [fileStorageContainer](../resources/filestoragecontainer.md) identified by `b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop`.
165234

166235
#### Request
167236

‎api-reference/beta/api/filestoragecontainer-delete-sharepointgroups.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: "Delete sharePointGroup"
3-
description: "Delete a sharePointGroup object."
3+
description: "Delete a sharePointGroup object that is local to a fileStorageContainer."
44
author: "tmarwendo-microsoft"
55
ms.localizationpriority: medium
66
ms.subservice: "onedrive"
@@ -56,7 +56,7 @@ If successful, this method returns a `204 No Content` response code.
5656

5757
### Example 1: Delete a SharePoint group
5858

59-
The following example deletes a **sharePointGroup** identified by the ID `10` from the **fileStorageContainer** identified by the container ID `b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z`.
59+
The following example deletes a **sharePointGroup** identified by the ID `ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0` from the **fileStorageContainer** identified by the container ID `b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z`.
6060

6161
#### Request
6262

@@ -68,7 +68,7 @@ The following example shows a request.
6868
"name": "delete_sharepointgroup"
6969
}-->
7070
```http
71-
DELETE https://graph.microsoft.com/beta/storage/fileStorage/containers/b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z/sharePointGroups/10
71+
DELETE https://graph.microsoft.com/beta/storage/fileStorage/containers/b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z/sharePointGroups/ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0
7272
```
7373

7474
# [C#](#tab/csharp)
@@ -112,7 +112,7 @@ HTTP/1.1 204 No Content
112112

113113
### Example 2: Attempt to delete a SharePoint group that doesn't exist
114114

115-
The following example attempts to delete a **sharePointGroup** identified by the ID `11` from the **fileStorageContainer** identified by the container ID `b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z`; however, the group doesn't exist in the container.
115+
The following example attempts to delete a **sharePointGroup** identified by the ID `ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE1` from the **fileStorageContainer** identified by the container ID `b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z`; however, the group doesn't exist in the container.
116116

117117
#### Request
118118

@@ -122,7 +122,7 @@ The following example attempts to delete a **sharePointGroup** identified by the
122122
"name": "delete_nonexisting_sharepointgroup"
123123
}-->
124124
```http
125-
DELETE https://graph.microsoft.com/beta/storage/fileStorage/containers/b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z/sharePointGroups/11
125+
DELETE https://graph.microsoft.com/beta/storage/fileStorage/containers/b!ISJs1WRro0y0EWgkUYcktDa0mE8zSlFEqFzqRn70Zwp1CEtDEBZgQICPkRbil_5Z/sharePointGroups/ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE1
126126
```
127127

128128
# [C#](#tab/csharp)

0 commit comments

Comments
 (0)