Fix-6942-Added minimal permissions for 'entra m365group user'

[NishkalankBezawada]

Added minimal permissions for 'entra m365group user' commands

Updated documentation for the below commands to adhere the required minimal permissions.

• m365 entra m365group user add
• m365 entra m365group user list
• m365 entra m365group user remove
• m365 entra m365group user set

Linked Issue #6918

Closes #6942

Screenshots

• Add user as an Owner

m365 entra m365group user add --groupId 16765xxx-6xx5-xx14-b0xx-bfxxasdasxa24 --userNames '[email protected]' --role Owner

• Add user as a Member

m365 entra m365group user add --groupId 16765xxx-6xx5-xx14-b0xx-bfxxasdasxa24 --userNames '[email protected]' --role Member

• User list

m365 entra m365group user list --groupId 16765xxx-6xx5-xx14-b0xx-bfxxasdasxa24

• Set User

m365 entra m365group user set --groupId 16765xxx-6xx5-xx14-b0xx-bfxxasdasxa24 --userNames '[email protected]' --role Member

• Remove User

m365 entra m365group user remove --groupId 16765xxx-6xx5-xx14-b0xx-bfxxasdasxa24 --userNames '[email protected]'

Thanks,
Nish

[Jwaegebaert]

Nice work already @NishkalankBezawada. Looks like the docs build is failing. From a quick look at the changed files, it seems you're missing the imports for Tabs.

[NishkalankBezawada]

Nice work already @NishkalankBezawada. Looks like the docs build is failing. From a quick look at the changed files, it seems you're missing the imports for Tabs.

Thanks Jasey @Jwaegebaert for guiding. I have now corrected it 👍

//Nish

[Jwaegebaert]

Good start @NishkalankBezawada. I’ve added a few comments since the commands look a bit more complex than just requiring Group.ReadWrite.All. I also included some links to the Graph docs for reference.

[Jwaegebaert]

We’ll also need permissions when fetching users by userNames. In that case, an extra call will be made to the v1.0/users endpoint: https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0&tabs=http#permissions

Additionally, the docs mention that in delegated scenarios, the signed-in user must have at least a minimal role before being allowed to add new members (see the important admonition here: https://learn.microsoft.com/en-us/graph/api/group-post-members?view=graph-rest-1.0&tabs=http#permissions).

We might want to include that information as well, though I’m not entirely sure what the cleanest way to handle it would be. @pnp/cli-for-microsoft-365-maintainers any thoughts?

[Jwaegebaert]

This API appears to be a bit more complex. When an app only has GroupMember.Read.All permissions, it won’t return detailed user information, user objects will be null. I’d recommend including User.ReadBasic.All as the minimum permission for application-level access. (ref: https://learn.microsoft.com/en-us/graph/permissions-overview?tabs=http#limited-information-returned-for-inaccessible-member-objects)

The same applies to delegated scenarios, such as with m365group user add: https://learn.microsoft.com/en-us/graph/api/group-list-members?view=graph-rest-1.0&tabs=http#permissions

[Jwaegebaert]

A simular suggestion as for m365group user add apply here. An extra call will be made to the v1.0/users endpoint: https://learn.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0&tabs=http#permissions

[Jwaegebaert]

The same suggestions as for m365group user add apply here.