Breaking inheritance with Flow/PowerAutomate on a folder

[ArnaudB]

Hello,

Trying power automate/Flow, i try to solve an issue.

My goal :

1. Read an excel table (with student's mail),
2. Create a folder with name "student mail", for each student, in a folder of a team,
3. Remove members access,
4. Grant access to the specific student and me.

The point 3 makes me cry as you can see on the captures. I am a owner of the team.

Capture 1 : http://tondamrik.free.fr/img1.png

Capture 2 : http://tondamrik.free.fr/img2.png

Probably, i misunderstand something but what ?

Thanks for your precious help.

[sudharsan1985]

Hi, you had mentioned folder. Where is the folder? whether you are mentioning the folders in the SharePoint list or something. Also, the link to the images are broken.

[ArnaudB]

Hello @sudharsan1985 ,

First, thanks four your answer : links are able now.

In fact, i want to create a folder in tab "Files" of a channel in Teams. It works but it is shared with all members (students) and i want it shared only with one of them.
But i am not able to change permissions of this new folder.

My goal is to have a flow that creates a folder only shared with a student and me, for each student.

Hope, you'll see what i mean... 😕

[sudharsan1985]

Hi @ArnaudB 

The images are working now but I am sorry, I couldn't understand the language. Creating folders in the Files tab of the Teams Channel is nothing but creating the folder in the Teams associated SharePoint site. Before assigning the permissions or removing the permissions, you have to break the inheritance of the permission from the parent.

1. Please use the 'Send HTTP...' SharePoint action to break the inheritance and clear all the inherited permissions like shown below

 2. To find the role definition id, here I find the Contribute permission level id to assign to the user.

 3. The next step is to find the User's id, by using the action mentioned below. You have to pass the user's claims value to get the ID.

4. Assign the permission to the user using user id and the role definition id

If everything goes well, only you and the student should see the folder. Try it and let us know if you have any issues.

[ArnaudB]

---

@sudharsan1985 wrote:

Hi @ArnaudB 

The images are working now but I am sorry, I couldn't understand the language. Creating folders in the Files tab of the Teams Channel is nothing but creating the folder in the Teams associated SharePoint site. Before assigning the permissions or removing the permissions, you have to break the inheritance of the permission from the parent.

---

I agree with the first point (Folder in Files tab in Teams = folder in SharePoint Site) ;-).
I have just thought that breaking inheritance could be done with the Flow "block" (?) : STOP SHARING A FILE as said in many docs and tutos.

There is here something with i don't figure out / don't understand.

And... thanks a lot to try understand my langage. Sorry.

[sudharsan1985 · Accepted solution]

Hi, you are right there is an action 'Stop sharing an item or file' but you can't use a folder as an item for this action.

[ArnaudB]

Hello @sudharsan1985 !

Aaaahh, that's why it doesn't work !
So i may go around  : one folder by student with access for all (inheritance) but each new file in the folder of student XXX is a trigger for stopping sharing this new file and granting specific access. It sounds to me like an acceptable solution. I will try.

Thanks for your time and precious advices.

Arnaud.

[sudharsan1985]

Hi, if you restrict the folder to yourself and the student, then the files inside the folder will inherit the permission of the folder by default and there is no need to break the inheritance of each file and do the same.

[ArnaudB]

I understand and i am able (i think) to do it with your advices, but all the teachers around me will not be able except if i use dynamic variables in the script and share it with them... hmmm... I will consider this possibility ;-).

Thanks.

[ArnaudB]

Hello @sudharsan1985 

If you have time, i would like to have some explanations. I have 2 possibilities.

Possibility 1:

1. The teacher creates an xlsx file with students's email and saves it on his OneDrive Business.
2. Flow gets O365 teacher's profil...
3. ... and lists rows in the xlsx file on teacher's drive.
4. For each loop : CREATE A FOLDER named with students's email (or name from xlsx file);

The next step is to break inheritance on the folder and grant edit access to the students. But these actions need to get new folder'ID : i don't know how. On your captures, i can read  : 'list name' in the API REST. What is it please ?

Possibility 2 :

1. The teacher creates manually a folder named DEPOT_DE_TRAVAUX and manually restrict the access (no access for visitors and members) : so, each new folder created in it can be view/edit only by the teacher and the student by inheritance.
2. The teacher creates an xlsx file with students's email and saves it on his OneDrive Business.
3. Flow gets O365 teacher's profil... ... and lists rows in the xlsx file on teacher's drive.
4. For each loop : CREATE A FOLDER named with students's email (or name from xlsx file) Grant access to the student (edit mode).

Once again, i have to get the new folder's ID...

Your advices are welcome ;-).

Arnaud.

[ArnaudB]

Good evening,

I think i have understood :

- the 'Listname' is a SP List in which you have written the name of the folder ? If it's correct, is there a way not to use a SP List ?
This or something like below could be a clue/way ? 

_api/V2.0/drive/root/Documents/{id of the folder}......

- using 'data operations', i got the ID of my new folder i was looking for ;-).

Thanks !

[ArnaudB]

Hello,

I've gone forward
I am able to create one folder per student listed in excel file and grant edit access.

So i have decided to choose a way between the two i mentioned ; the flow must :

- create a folder named 'works' (for example...),

- break inheritance for it,

- create one subfolder per student in it,-

- grant edit access for each folder/student.

I am near from the solution, but Break inheritance is the last point i fall.

It seems that the process is too long, and ends by time-out. I had a look in 'result' and i saw : 'bad gateway'.

Could anyone give me a clue about this ?

Thank you,

Arnaud.

[ArnaudB]

I have solved it.

My Uri wal bad formatted.

Now, my flow works !

Thanks.

[delicatebeing1]

Hey there,

dear @sudharsan1985 

Please help me too 🙂

i have been following your guides on removing user access removal from a sharepoint list item, but i receive following error

[sudharsan1985]

Hi,

Based on the screenshot, the error is because the user claim id is not properly formed. Make sure you are passing the users claim id properly.

[delicatebeing1]

do you mind if I ask further elaboration on how to generate a proper user claim id?

What I did, plainly selecting assigned user email in a sharepoint list. And user id is something dynamic for me as the assignee for a SP item will always tend to be unique users.
My purpose here is to remove access of a specialist who needs temporarily access to edit an item, once he is done, his access is to removed acc to my flow. Which is why I created a SP group where specialists are dragged in, using the related group id too
Further, did I also arrange a proper coding for removing user permission as on the screen shot?

[delicatebeing1]

dear @sudharsan1985 

so I have such a SP group that authorizes invited external specialists by adding in this group ( grant access + https commands)

All I need is to remove a user attributed with a certain sharepoint item, once he is done with editing. On the other hand another owner group, on me, for regulating all that stuff