manage permissions

[Adam-it]

If noticed that CLI for Microsoft 365 is lacking commands that allow to manage unique permissions, or maybe I am not looking for them in the right place 😅.
For example I think the tool could have commands that allow to break inheritance on a list or item (file/folder) and then to add/remove role assignments (groups or users with specific permissions)... and of course to remove unique permissions as well.
For this we could use standard SharePoint Rest API and endpoints like

/_api/web/lists/getbytitle('SomeList')/items(1)/breakroleinheritance(false)

to break inheritance without inheriting current permissions on item with ID 1 on "SomeList"
or

/_api/web/lists/getbytitle("SomeList")/items(1)/roleassignments/addroleassignment(principalid='{SomeGroupOrUserIDHere}',roledefid='{SomeRoleIdHere}')

to add some group or user with specified role to some item on some list.
We would also need some commands, like get or/and list, for roles definitions form Site or Web. For example we may use this

/_api/web/roledefinitions/getbyname('"someRoleName')

to get some role. Usually we need the ID to use it in role assignments.

What do you think? Do you think this kind of commands could be useful?
For example I noticed some script samples that use PnP.PowerShell for this kind of permission/inheritance breaking kind of operations on SharePoint and I could not currently rewrite them with CLI, so I think those kind of commands could be a good addition to the tool.
If you agree, then what would be the commands? We need some to get roledefenitions and then some to manage permissions (break, add roleassignemnt, remove roleassignemntm, remove unique permissions etc.) on levels like lists, item, file, folder etc. 🤔

[waldekmastykarz]

I think all commands you suggested would be a great addition to the CLI. Let's break them down into separate issues and work on the design. Thank you for the suggestion! 👏

[Adam-it]

ok cool. Will start adding issues and going one by one with the functionality.

The first needed step is breaking inheritance so we may even start 😉

second step will be retrieving site available roles which we may use while adding permissions (in the mean time we need adding/removing roles etc.)

then the final step will be to grant/remove permission for some item/list/etc for group or user with specific role (so we need possibility to get user or group (this we have) list or item (this we have), and role (this we need to also add)

[waldekmastykarz]

Awesome! Let's start working on it 🚀

[Adam-it]

moved to 👉 #3540