Grant access to external users

Question

How can I grant access to external uses by Rest api?

Answer 1

Hi @lilyvalley-8419,

Thank you for posting in this community.

First of all, I would like to check with you if you have added external users to your site?

Because SharePoint Rest Api doesn't have a way to invite external users to the site. This is because adding external users requires both tenant and site settings. These settings must be set by the SharePoint administrator. So SharePoint Rest Api does not provide an Api for inviting external users.

The only thing it can do is to modify the permissions of external users to certain resources in the site to gain access to those resources.

If you haven't invited external users to your site yet, please refer to the steps below to do so:

1. Check your organization-level external sharing setting. Choose the right option for your needs.
2. Check your site-level external sharing setting. Choose the right option for your needs.
3. Once external sharing is enabled, you can invite external users to your SharePoint site:
   1. Navigate to the SharePoint site where you want to add the external user.
   2. Click on the gear icon (Settings) in the upper-right corner and select Site permissions.
   3. Click on Invite people and then Add members to group or Share site only.
   4. Enter the email address of the external user you want to invite.
   5. Select the appropriate permission level (e.g., "Can view" or "Can edit").
   6. Click Share. The external user will receive an email invitation to join the site.

After you've added external users we can use the Rest API to give them access to the site's content.

Please contact the owner or administrator of your site to perform the following Rest Api request:

1. Get User Principal ID: Before assigning permissions, you need the user's principal ID.

      GET /_api/web/SiteUsers/GetByEmail('user@example.com')/Id
   

2. Break Permission Inheritance: If the resource inherits permissions from a parent, you need to break this inheritance.

      POST /_api/web/lists/GetByTitle('Documents')/breakroleinheritance(copyRoleAssignments=true, clearSubscopes=true)
   

3. Assign Permissions: Finally, assign the desired permissions to the user.

      POST /_api/web/lists/GetByTitle('Documents')/roleassignments/addroleassignment(principalid=9, roledefid=1073741827)
   

   • principalid: The ID of the user or group.
   • roledefid: The ID of the permission level (e.g., Full Control, Contribute, Read).

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.