How to get the Members of a Security Group via API

Question

A customer of ours has their Sharepoint Online access permissions configured via (non-azure) security groups.

We query the roles attached to an item in Sharepoint via the Sharepoint REST API with the following request:

https://<tenant>.sharepoint.com/sites/TestSite/_api/web/RoleAssignments?$expand=Member/Users

And the response looks something like this:

{
    "odata.metadata": "https://<tenant>.sharepoint.com/sites/TestSite/_api/$metadata#SP.ApiData.RoleAssignments",
    "value": [
        {
            "odata.type": "SP.RoleAssignment",
            "odata.id": "https://<tenant>.sharepoint.com/sites/TestSite/_api/Web/RoleAssignments/GetByPrincipalId(3)",
            "odata.editLink": "Web/RoleAssignments/GetByPrincipalId(3)",
            "Member@odata.navigationLinkUrl": "Web/RoleAssignments/GetByPrincipalId(3)/Member",
            "Member": {
                "odata.type": "SP.Group",
                "odata.id": "https://<tenant>.sharepoint.com/sites/TestSite/_api/Web/RoleAssignments/GetByPrincipalId(3)/Member",
                "odata.editLink": "Web/RoleAssignments/GetByPrincipalId(3)/Member",
                "Users@odata.navigationLinkUrl": "Web/RoleAssignments/GetByPrincipalId(3)/Member/Users",
                "Users": [
                    {
                        "odata.type": "SP.User",
                        "odata.id": "https://<tenant>.sharepoint.com/sites/TestSite/_api/Web/GetUserById(8)",
                        "odata.editLink": "Web/GetUserById(8)",
                        "Id": 8,
                        "IsHiddenInUI": true,
                        "LoginName": "c:0o.c|federateddirectoryclaimprovider|<some hexadecimal ID>_o",
                        "Title": "Besitzer von TestSite",
                        "PrincipalType": 4,
                        "Email": "TestSite@<tenant>.onmicrosoft.com",
                        "Expiration": "",
                        "IsEmailAuthenticationGuestUser": false,
                        "IsShareByEmailGuestUser": false,
                        "IsSiteAdmin": true,
                        "UserId": null,
                        "UserPrincipalName": null
                    }
                ],
                "Id": 3,
                "IsHiddenInUI": false,
                "LoginName": "TestSite Owners",
                "Title": "TestSite Owners",
                "PrincipalType": 8,
                "AllowMembersEditMembership": false,
                "AllowRequestToJoinLeave": false,
                "AutoAcceptRequestToJoinLeave": false,
                "Description": null,
                "OnlyAllowMembersViewMembership": false,
                "OwnerTitle": "TestSite Owners",
                "RequestToJoinLeaveEmailSetting": ""
            },
            "PrincipalId": 3
        }
    ]
}

Now, according to the microsoft documentation, PrincipalType 4 means that the "user" really is a "SecurityGroup". In our test system, the security group has an Azure ID which makes it relatively easy to get information on via the Graph API. But in our customer's system the ID is some 16 digit hexadecimal string in a format that I can't find anywhere else.

How can I find the members of this "SecurityGroup" via any API?

Answer 1

try out : https://sharepoint_tenant/path_to_site/_api/Web/SiteGroups/GetByName('groupname')/users

You can select properties to return appending ?$select="properties to return"