Skip to content

Fix-6942-Added minimal permissions for 'entra m365group user' #6999

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
NishkalankBezawada wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

Fix-6942-Added minimal permissions for 'entra m365group user' #6999

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c4352df
Fix-6942-Added minimal permissions for 'entra m365group user'
NishkalankBezawada Oct 13, 2025
71abb2f
updating minimal permission check with devproxy
NishkalankBezawada Oct 13, 2025
c1d4feb
Added tab imports - Resolving comments by Jasey
NishkalankBezawada Oct 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions docs/docs/cmd/entra/m365group/m365group-user-add.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,25 @@ m365 teams user add [options]

<Global />

## Permissions

<Tabs>
<TabItem value="Delegated">

| Resource | Permissions |
|-----------------|-----------------------------|
| Microsoft Graph | Group.ReadWrite.All |

</TabItem>
<TabItem value="Application">

| Resource | Permissions |
|-----------------|-----------------------------|
| Microsoft Graph | Group.ReadWrite.All |

</TabItem>
</Tabs>
Comment on lines +50 to +65
Copy link
Contributor

@Jwaegebaert Jwaegebaert Oct 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We’ll also need permissions when fetching users by userNames. In that case, an extra call will be made to the v1.0/users endpoint: https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0&tabs=http#permissions

Additionally, the docs mention that in delegated scenarios, the signed-in user must have at least a minimal role before being allowed to add new members (see the important admonition here: https://learn.microsoft.com/en-us/graph/api/group-post-members?view=graph-rest-1.0&tabs=http#permissions).

We might want to include that information as well, though I’m not entirely sure what the cleanest way to handle it would be. @pnp/cli-for-microsoft-365-maintainers any thoughts?


## Examples

Add a new member with the userNames parameter to the specified Microsoft 365 Group.
Expand Down
19 changes: 19 additions & 0 deletions docs/docs/cmd/entra/m365group/m365group-user-list.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,25 @@ m365 entra m365group user list [options]

<Global />

## Permissions

<Tabs>
<TabItem value="Delegated">

| Resource | Permissions |
|-----------------|-----------------------------|
| Microsoft Graph | GroupMember.Read.All |

</TabItem>
<TabItem value="Application">

| Resource | Permissions |
|-----------------|-----------------------------|
| Microsoft Graph | GroupMember.Read.All |

</TabItem>
</Tabs>
Comment on lines +38 to +53
Copy link
Contributor

@Jwaegebaert Jwaegebaert Oct 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This API appears to be a bit more complex. When an app only has GroupMember.Read.All permissions, it won’t return detailed user information, user objects will be null. I’d recommend including User.ReadBasic.All as the minimum permission for application-level access. (ref: https://learn.microsoft.com/en-us/graph/permissions-overview?tabs=http#limited-information-returned-for-inaccessible-member-objects)

The same applies to delegated scenarios, such as with m365group user add: https://learn.microsoft.com/en-us/graph/api/group-list-members?view=graph-rest-1.0&tabs=http#permissions


## Remarks

When the `properties` option includes values with a `/`, for example: `manager/displayName`, an additional `$expand` query parameter will be included on `manager`.
Expand Down
19 changes: 19 additions & 0 deletions docs/docs/cmd/entra/m365group/m365group-user-remove.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,25 @@ m365 entra m365group user remove [options]

<Global />

## Permissions

<Tabs>
<TabItem value="Delegated">

| Resource | Permissions |
|-----------------|-----------------------------|
| Microsoft Graph | Group.ReadWrite.All |

</TabItem>
<TabItem value="Application">

| Resource | Permissions |
|-----------------|-----------------------------|
| Microsoft Graph | Group.ReadWrite.All |

</TabItem>
</Tabs>
Comment on lines +44 to +59
Copy link
Contributor

@Jwaegebaert Jwaegebaert Oct 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A simular suggestion as for m365group user add apply here. An extra call will be made to the v1.0/users endpoint: https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0&tabs=http#permissions


## Remarks

You can remove users from a Microsoft 365 Group or Microsoft Teams team if you are owner of that group or team.
Expand Down
19 changes: 19 additions & 0 deletions docs/docs/cmd/entra/m365group/m365group-user-set.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,25 @@ m365 entra m365group user set [options]

<Global />

## Permissions

<Tabs>
<TabItem value="Delegated">

| Resource | Permissions |
|-----------------|-----------------------------|
| Microsoft Graph | Group.ReadWrite.All |

</TabItem>
<TabItem value="Application">

| Resource | Permissions |
|-----------------|-----------------------------|
| Microsoft Graph | Group.ReadWrite.All |

</TabItem>
</Tabs>
Comment on lines +44 to +59
Copy link
Contributor

@Jwaegebaert Jwaegebaert Oct 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The same suggestions as for m365group user add apply here.


## Remarks

The command will return an error if the user already has the specified role in the given Microsoft 365 Group or Microsoft Teams team.
Expand Down
Loading