Move user from SharePoint group to Office 365 group

[commguy]

What I am looking to do: 

When a user is added to a SharePoint Online Members group; remove the users from that group and add them to a specified Office 365 group. Is this possible? 

Reasoning (if you care):

We need a way to perform attestation for SharePoint sites; meaning reviewing who has access periodically and approving / denying users who have access to a specific site. We can do this if we assign an O365 group to a SharePoint site as site members; we then are able to use Azure AD Group Access reviews where the owner is forced to periodically review users in that group.

However the problem is; when a user requests access to a SharePoint site and a site admin accepts the request; the users is added to the Site Members (a SharePoint group); which is not a Group in Azure AD. Only SharePoint knows about it so we cannot perform access review on it from AAD Access Reviews.

If we could force access request approvals to use the O365 group instead of being added direct to the site; then we could perform access review on that group.

Or, if Access reviews could be performed on SharePoint groups; that would also solve the issue. However; neither are possible so I am turning to Power Automate to see if it can help.

[DamoBird365]

Hi @commguy 

I can sympathise, as I've been there and I disabled the ability to request access to a site as part of site builds for our "main" sites.  You'll probably want to setup a recurrence trigger, once a day to perform this administrative task, if the end users are willing to wait.

You can get members of the SharePoint groups using the SharePoint Rest API which can be called from Power Automate.  You're looking for something like https://abdndamodev.sharepoint.com/sites/DamoBird365/_api/web/sitegroups/GetByName('damobird365%20me... which will return a JSON array of members that you could parse.  I've not explored the API in full https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/get-to-know-the-sharepoint-rest-service?t... but i'm assuming you can update the groups using the API too.  Others might be able to confirm but you might be happy to explore.

Once you've got your list of users and the ability to delete them from the SharePoint group, adding them to an O365 Group is easy enough and I guess you have that covered?  But if you need help, let me/us know.  

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Cheers,
Damien

P.S. take a look at my new blog here

[commguy]

Thank you Damien, I actually do not have anything covered to be honest. I am brand new to Power Automate, have no experience, I am an O365 admin trying to meet this need we have and thought it may be possible with Power Automate based on some other things I have read about Power Automate. I could use all the help I can get, but will try to experiment and see what I can make happen... 

[commguy]

Does anyone have a way to accomplish this?