Remove permissions from a specific SharePoint user with Power Automate

“I don’t want to remove all permissions and add them again just to remove one SharePoint user, is there an easier way to do it using Power Automate?”

---

If you manage SharePoint permissions in your Power Automate flow, you don’t have many options. There’re 2 dedicated actions: ‘Stop sharing an item or a file’ and ‘Grant access to an item or a folder’. One action that’ll remove all permissions (and doesn’t work on folders), and the other to assign permissions (but doesn’t work with SharePoint groups). That’s it, everything else needs an HTTP request.

But there’re situations when you don’t want to remove all the permissions and add them all again, with only minor changes. For example, an approval process where everyone can edit only during their approval step. Why should you remove all the permissions and add them all again just to change contribute to read for one user?

Get the user principalId

As you probably realised, you’ll need another HTTP request. When you manage permissions via HTTP requests, you always work with the user princialId. That’s not the standard user id which you can see e.g. in Planner tasks. This id can be different on each SharePoint site. Therefore, if you want to remove permissions on a specific site, you must get the id from the site.

Method: GET

Uri:
_api/web/SiteUsers/getByEmail('<user email address>')/Id

Note: <…> is a placeholder, replace it including the < and >.

The result will contain the principalId of the user on the specific site. Use an expression to extract the id from the JSON output.

body('Send_an_HTTP_request_to_SharePoint')?['d']?['Id']

Remove the permissions with an HTTP request

Now, when you have the id, you can use it in an HTTP request to remove permissions from this user.

Method: DELETE

Uri:
_api/web/lists/getByTitle('<listName>')/items(<itemId>)/roleassignments(<principalId>)

Note: <…> is a placeholder, replace it including the < and >.

At this point you can use the ‘Grant access to an item or a file’ action to give the user different permissions than he had, or you can leave him without access.

Summary

It is possible to remove permissions only from a single SharePoint user in Power Automate flow, but it needs another set of HTTP requests. The first one will give you the user principalId which is different for each SharePoint site. If you want to remove permissions from multiple sites, you’ll have to ask each of them. The second request will take this principalId and use it to remove the permissions.

---

Do you struggle with the various expressions, conditions, filters, or HTTP requests available in Power Automate?

I send one email per week with a summary of the new solutions, designed to help even non IT people to automate some of their repetitive tasks.

All subscribers have also access to resources like a SharePoint Filter Query cheat sheet or Date expressions cheat sheet.

First Name

Email address

Zero spam, unsubscribe anytime.

Leave this field empty if you’re human: