Skip to content

Commit 0f6adeb

Browse files
fabianhutzlifabianhutzli
committed
Add Get, Grant, Set and Revoke cmdlets for EntraID app list item permissions
Implements ListItems.SelectedOperations.Selected support via the Microsoft Graph beta API. The -ListItem parameter accepts the integer item ID only. Lists can be addressed by GUID or display name. Permission roles use the correct list-level values (Read, Write, Owner). Display names are enriched via service principal lookup since the Graph beta API omits them on GET responses. Documentation included.
1 parent fd8e757 commit 0f6adeb

11 files changed

Lines changed: 1288 additions & 0 deletions

‎documentation/Get-PnPEntraIDAppListItemPermission.md‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
---
2+
Module Name: PnP.PowerShell
3+
schema: 2.0.0
4+
applicable: SharePoint Online
5+
online version: https://pnp.github.io/powershell/cmdlets/Get-PnPEntraIDAppListItemPermission.html
6+
external help file: PnP.PowerShell.dll-Help.xml
7+
title: Get-PnPEntraIDAppListItemPermission
8+
---
9+
10+
# Get-PnPEntraIDAppListItemPermission
11+
12+
## SYNOPSIS
13+
14+
**Required Permissions**
15+
16+
* Microsoft Graph API: Sites.ReadWrite.All
17+
18+
Returns Entra ID App permissions for a list item.
19+
20+
## SYNTAX
21+
22+
### All Permissions
23+
```powershell
24+
Get-PnPEntraIDAppListItemPermission -List <String> -ListItem <Int32> [-Site <SitePipeBind>] [-Connection <PnPConnection>]
25+
```
26+
27+
### By Permission Id
28+
```powershell
29+
Get-PnPEntraIDAppListItemPermission -PermissionId <String> -List <String> -ListItem <Int32> [-Site <SitePipeBind>] [-Connection <PnPConnection>]
30+
```
31+
32+
### By App Display Name or App Id
33+
```powershell
34+
Get-PnPEntraIDAppListItemPermission -AppIdentity <String> -List <String> -ListItem <Int32> [-Site <SitePipeBind>] [-Connection <PnPConnection>]
35+
```
36+
37+
## DESCRIPTION
38+
39+
This cmdlet returns app permissions for a list item in either the current or a given site. It is used in conjunction with the Entra ID SharePoint application permission `ListItems.SelectedOperations.Selected`.
40+
41+
The `-ListItem` parameter accepts the integer item ID. Use `Get-PnPListItem` to look up the ID if needed.
42+
43+
## EXAMPLES
44+
45+
### EXAMPLE 1
46+
```powershell
47+
Get-PnPEntraIDAppListItemPermission -List "Documents" -ListItem 5
48+
```
49+
50+
Returns all app permissions set on the list item with integer id 5 in the Documents library of the currently connected site.
51+
52+
### EXAMPLE 2
53+
```powershell
54+
Get-PnPEntraIDAppListItemPermission -List "Documents" -ListItem 5 -Site https://contoso.sharepoint.com/sites/projects
55+
```
56+
57+
Returns all app permissions set on list item 5 in the Documents library of the specified site collection.
58+
59+
### EXAMPLE 4
60+
```powershell
61+
Get-PnPEntraIDAppListItemPermission -List "Documents" -ListItem 5 -PermissionId aTowaS50fG1zLnNwLmV4dHxlMzhjZmIzMS00
62+
```
63+
64+
Returns the specific permission details for the given permission id on the list item.
65+
66+
### EXAMPLE 5
67+
```powershell
68+
Get-PnPEntraIDAppListItemPermission -List "Documents" -ListItem 5 -AppIdentity "My App"
69+
```
70+
71+
Returns the specific permission details for the app with the provided display name on the list item.
72+
73+
### EXAMPLE 6
74+
```powershell
75+
Get-PnPEntraIDAppListItemPermission -List "Documents" -ListItem 5 -AppIdentity "89ea5c94-7736-4e25-95ad-3fa95f62b66e"
76+
```
77+
78+
Returns the specific permission details for the app with the provided app id on the list item.
79+
80+
## PARAMETERS
81+
82+
### -AppIdentity
83+
Specify either the display name or the app id (client id) to filter the returned permissions to a specific app.
84+
85+
```yaml
86+
Type: String
87+
Parameter Sets: By App Display Name or App Id
88+
89+
Required: True
90+
Position: Named
91+
Default value: None
92+
Accept pipeline input: False
93+
Accept wildcard characters: False
94+
```
95+
96+
### -Connection
97+
Optional connection to be used by the cmdlet. Retrieve the value for this parameter by either specifying -ReturnConnection on Connect-PnPOnline or by executing Get-PnPConnection.
98+
99+
```yaml
100+
Type: PnPConnection
101+
Parameter Sets: (All)
102+
103+
Required: False
104+
Position: Named
105+
Default value: None
106+
Accept pipeline input: False
107+
Accept wildcard characters: False
108+
```
109+
110+
### -List
111+
The list containing the item. Accepts a list GUID or display name.
112+
113+
```yaml
114+
Type: String
115+
Parameter Sets: (All)
116+
117+
Required: True
118+
Position: Named
119+
Default value: None
120+
Accept pipeline input: False
121+
Accept wildcard characters: False
122+
```
123+
124+
### -ListItem
125+
The integer ID of the list item to retrieve permissions for. Use `Get-PnPListItem` to look up the ID if needed.
126+
127+
```yaml
128+
Type: Int32
129+
Parameter Sets: (All)
130+
131+
Required: True
132+
Position: Named
133+
Default value: None
134+
Accept pipeline input: False
135+
Accept wildcard characters: False
136+
```
137+
138+
### -PermissionId
139+
If specified, the permission with that id will be retrieved.
140+
141+
```yaml
142+
Type: String
143+
Parameter Sets: By Permission Id
144+
145+
Required: True
146+
Position: Named
147+
Default value: None
148+
Accept pipeline input: False
149+
Accept wildcard characters: False
150+
```
151+
152+
### -Site
153+
Optional url of a site to retrieve the permissions for. Defaults to the currently connected site.
154+
155+
```yaml
156+
Type: SitePipeBind
157+
Parameter Sets: (All)
158+
159+
Required: False
160+
Position: Named
161+
Default value: Currently connected site
162+
Accept pipeline input: False
163+
Accept wildcard characters: False
164+
```
165+
166+
## RELATED LINKS
167+
168+
[Microsoft 365 Patterns and Practices](https://aka.ms/m365pnp)

‎documentation/Grant-PnPEntraIDAppListItemPermission.md‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
---
2+
Module Name: PnP.PowerShell
3+
schema: 2.0.0
4+
applicable: SharePoint Online
5+
online version: https://pnp.github.io/powershell/cmdlets/Grant-PnPEntraIDAppListItemPermission.html
6+
external help file: PnP.PowerShell.dll-Help.xml
7+
title: Grant-PnPEntraIDAppListItemPermission
8+
---
9+
10+
# Grant-PnPEntraIDAppListItemPermission
11+
12+
## SYNOPSIS
13+
14+
**Required Permissions**
15+
16+
* Microsoft Graph API: Sites.ReadWrite.All
17+
18+
Adds permissions for a given Entra ID application registration on a list item.
19+
20+
## SYNTAX
21+
22+
```powershell
23+
Grant-PnPEntraIDAppListItemPermission -AppId <Guid> -DisplayName <String> -Permissions <Read|Write|Owner> -List <String> -ListItem <Int32> [-Site <SitePipeBind>] [-Connection <PnPConnection>]
24+
```
25+
26+
## DESCRIPTION
27+
28+
This cmdlet adds permissions for a given Entra ID application registration on a list item. It is used in conjunction with the Entra ID SharePoint application permission `ListItems.SelectedOperations.Selected`.
29+
30+
The `-ListItem` parameter accepts the integer item ID. Use `Get-PnPListItem` to look up the ID if needed.
31+
32+
## EXAMPLES
33+
34+
### EXAMPLE 1
35+
```powershell
36+
Grant-PnPEntraIDAppListItemPermission -AppId "aa37b89e-75a7-47e3-bdb6-b763851c61b6" -DisplayName "TestApp" -Permissions Read -List "Documents" -ListItem 5
37+
```
38+
39+
Grants the Entra ID application registration Read access on list item 5 in the Documents library of the currently connected site.
40+
41+
### EXAMPLE 2
42+
```powershell
43+
Grant-PnPEntraIDAppListItemPermission -AppId "aa37b89e-75a7-47e3-bdb6-b763851c61b6" -DisplayName "TestApp" -Permissions Owner -List "Documents" -ListItem 5 -Site https://contoso.sharepoint.com/sites/projects
44+
```
45+
46+
Grants Owner access on list item 5 in the Documents library of the specified site collection.
47+
48+
## PARAMETERS
49+
50+
### -AppId
51+
The app id (client id) of the Entra ID application registration to grant permission for.
52+
53+
```yaml
54+
Type: Guid
55+
Parameter Sets: (All)
56+
57+
Required: True
58+
Position: Named
59+
Default value: None
60+
Accept pipeline input: False
61+
Accept wildcard characters: False
62+
```
63+
64+
### -Connection
65+
Optional connection to be used by the cmdlet. Retrieve the value for this parameter by either specifying -ReturnConnection on Connect-PnPOnline or by executing Get-PnPConnection.
66+
67+
```yaml
68+
Type: PnPConnection
69+
Parameter Sets: (All)
70+
71+
Required: False
72+
Position: Named
73+
Default value: None
74+
Accept pipeline input: False
75+
Accept wildcard characters: False
76+
```
77+
78+
### -DisplayName
79+
The display name to associate with the permission. Used for visual reference only; does not need to match the application name in Entra ID.
80+
81+
```yaml
82+
Type: String
83+
Parameter Sets: (All)
84+
85+
Required: True
86+
Position: Named
87+
Default value: None
88+
Accept pipeline input: False
89+
Accept wildcard characters: False
90+
```
91+
92+
### -List
93+
The list containing the item. Accepts a list GUID or display name.
94+
95+
```yaml
96+
Type: String
97+
Parameter Sets: (All)
98+
99+
Required: True
100+
Position: Named
101+
Default value: None
102+
Accept pipeline input: False
103+
Accept wildcard characters: False
104+
```
105+
106+
### -ListItem
107+
The integer ID of the list item to grant permissions on. Use `Get-PnPListItem` to look up the ID if needed.
108+
109+
```yaml
110+
Type: Int32
111+
Parameter Sets: (All)
112+
113+
Required: True
114+
Position: Named
115+
Default value: None
116+
Accept pipeline input: False
117+
Accept wildcard characters: False
118+
```
119+
120+
### -Permissions
121+
The permissions to grant for the Entra ID application registration. Can be Read, Write, or Owner.
122+
123+
```yaml
124+
Type: String
125+
Parameter Sets: (All)
126+
127+
Required: True
128+
Accepted values: Read, Write, Owner
129+
Position: Named
130+
Default value: None
131+
Accept pipeline input: False
132+
Accept wildcard characters: False
133+
```
134+
135+
### -Site
136+
Optional url of a site to grant the permissions on. Defaults to the currently connected site.
137+
138+
```yaml
139+
Type: SitePipeBind
140+
Parameter Sets: (All)
141+
142+
Required: False
143+
Position: Named
144+
Default value: Currently connected site
145+
Accept pipeline input: False
146+
Accept wildcard characters: False
147+
```
148+
149+
## RELATED LINKS
150+
151+
[Microsoft 365 Patterns and Practices](https://aka.ms/m365pnp)

0 commit comments

Comments
 (0)