title: Using ms-graph 'Sites.Selected' permission to read role-assignments on Sharepoint document libraries
body: <p>I am building an app which needs to be able to read role-assignments from document libraries on a specific Sharepoint site with the help of ms-graph. The <a href="https://developer.microsoft.com/en-us/graph/blogs/controlling-app-access-on-specific-sharepoint-site-collections/" rel="nofollow noreferrer">Sites.Selected</a> API permission works almost perfectly for my use case but for some reason I can't retrieve all role-assignments on document libraries without <em>Sites.FullControl.All</em>. I can still retrieve roles from folders and files below a document library.</p>
  <p>With the code below I am able to see that 'James Doe' has 'write' permissions to a library while <em>Sites.FullControl.All</em> is active for my app registration and without it the <em>roles</em> attribute holds no elements</p>
  <pre class="lang-cs prettyprint-override"><code>var docLibs = await graphServiceClient.Sites[this.siteId].Drives
      .Request().GetAsync();
  
  foreach (var docLib in docLibs){
      var perms = await graphServiceClient.Sites[siteId].Drives[$&quot;{docLib.Id}&quot;]
           .Root.Permissions.Request().GetAsync(); 
  
      foreach (var perm in perms) {
          Console.WriteLine($&quot;{perm.GrantedTo.User.DisplayName} - {Perm.Roles.ToList().Count}&quot;);
      }
  }
  
  // With Sites.Selected (using ['write'] permission):
  //  ==&gt; James Doe - 0
  
  // With Sites.FullControl.All:
  //  ==&gt; James Doe - 1
  
  </code></pre>
  <p><img src="https://i.imgur.com/qdgHpU8.png" alt="" /></p>
  <p><img src="https://i.imgur.com/4iGfYeG.png" alt="" /></p>
  <p>I've tried many other API permission but only <em>Sites.FullControl.All</em> seem to enable the reading of role-assignments correctly. I am looking for a less privileged alternative that still enables the reading of role-assignments on document libraries.</p>
  <p>The best solution would be if <a href="https://developer.microsoft.com/en-us/graph/blogs/controlling-app-access-on-specific-sharepoint-site-collections/" rel="nofollow noreferrer">Sites.Selected</a> could accept a request akin to</p>
  <pre class="lang-json prettyprint-override"><code>// POST https://graph.microsoft.com/v1.0/sites/&lt;...&gt;/permissions
  {
      &quot;roles&quot;: [
          &quot;sp.full control&quot; // Instead of 'write' 
      ],
      &quot;grantedToIdentities&quot;: [
          {
              &quot;application&quot;: {
                  &quot;id&quot;: &quot;11111111-1111-1111-1111-111111111111&quot;,
                  &quot;displayName&quot;: &quot;My graph App&quot;
              }
          }
      ]
  }
  </code></pre>
  <p>giving the application <em>FullControl</em> only to the specific site. However, I have not seen anyone being able to use roles besides <em>read</em> and <em>write</em> for the endpoint.</p>