对 driveItem 创建权限

命名空间：microsoft.graph

在 driveItem 上创建新的权限对象。

重要

此 API 具有以下限制：

对于 OneDrive for work 或 school 和 SharePoint Online，只能使用此方法创建新的应用程序权限。如果要在 driveItem 中创建新的用户权限，请参阅邀请。有关应用程序权限的详细信息，请参阅 OneDrive 和 SharePoint 中的所选权限概述。
对于 SharePoint Embedded，只能使用此方法创建具有仅应用访问权限的新 sharePointGroup 权限。无法对容器的根项创建权限。

全局服务	美国政府 L4	美国政府 L5 (DOD)	由世纪互联运营的中国
✅	✅	✅	✅

权限

为此 API 选择标记为最低特权的权限。只有在应用需要它时，才使用更高的特权权限。有关委派权限和应用程序权限的详细信息，请参阅权限类型。要了解有关这些权限的详细信息，请参阅权限参考。

权限类型	最低特权权限	更高特权权限
委派（工作或学校帐户）	Files.ReadWrite	Files。ReadWrite.All，Files。SelectedOperations.Selected、Sites.ReadWrite.All、Sites.FullControl.All、Sites.Manage.All、Sites.Selected、Lists.SelectedOperations.Selected、ListItems.SelectedOperations.Selected
委派（个人 Microsoft 帐户）	Files.ReadWrite	Files.ReadWrite.All
应用程序	Files.ReadWrite.All	Sites.FullControl.All、Sites.Manage.All、Sites.ReadWrite.All、Sites.Selected、Files。SelectedOperations.Selected、Lists.SelectedOperations.Selected、ListItems.SelectedOperations.Selected

注意

SharePoint Embedded 需要 FileStorageContainer.Selected 权限才能访问容器的内容。此权限不同于前面提到的权限。除了Microsoft Graph 权限外，应用还必须具有调用此 API 所需的容器类型权限。有关详细信息，请参阅 SharePoint Embedded 身份验证和授权。

HTTP 请求

POST /drives/{drive-id}/items/{item-id}/permissions
POST /groups/{group-id}/drive/items/{item-id}/permissions
POST /me/drive/items/{item-id}/permissions
POST /sites/{siteId}/drive/items/{itemId}/permissions
POST /users/{userId}/drive/items/{itemId}/permissions

请求标头

名称	说明
Authorization	持有者 {token}。必填。详细了解身份验证和授权。
Content-Type	application/json. 必需。

请求正文

在请求正文中，提供权限对象的 JSON 表示形式。

重要

此 API 仅接受 grantedToV2 作为权限对象的输入。其他属性（如 grantedToIdentitiesV2 或已弃用的 grantedTo 和 grantedToIdentities ）不会被接受。
对于 SharePoint Embedded，在创建新的 sharePointGroup 权限时，建议使用请求正文中的 grantedToV2.sharePointGroup.id 属性引用 sharePointGroup。此 ID 应映射到 sharePointGroup 属性的 ID。有关详细信息，请参阅示例 2。我们不建议使用其 principalId 引用 sharePointGroup，因为 principalId 在网站中是唯一的，这与 sharePointGroup 的 ID 不同，后者全局唯一。在这种情况下，请求正文必须在 grantedToV2.siteGroup 属性中包含 id 和 displayName。 ID 必须指向 sharePointGroup 的 principalId，displayName 必须指向 sharePointGroup 的标题。有关详细信息，请参阅示例 3。

响应

如果成功，此方法在 201 Created 响应正文中返回响应代码和权限对象。

示例

示例 1：在 OneDrive 或 SharePoint Online 中向 driveItem 添加应用程序权限

以下示例演示如何在由 89ea5c94-7736-4e25-95ad-3fa95f62b66e标识的Contoso Time Manager App驱动器中由标识01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU的 driveItem 上为标识b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop的应用程序添加write权限。

请求

以下示例显示了一个请求。

POST https://graph.microsoft.com/v1.0/drives/b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop/items/01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU/permissions
Content-Type: application/json

{
  "grantedToV2": {
    "application": {
      "id": "89ea5c94-7736-4e25-95ad-3fa95f62b66e"
    }
  },
  "roles": ["write"]
}


// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Models;

var requestBody = new Permission
{
	GrantedToV2 = new SharePointIdentitySet
	{
		Application = new Identity
		{
			Id = "89ea5c94-7736-4e25-95ad-3fa95f62b66e",
		},
	},
	Roles = new List<string>
	{
		"write",
	},
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Drives["{drive-id}"].Items["{driveItem-id}"].Permissions.PostAsync(requestBody);



// Code snippets are only available for the latest major version. Current major version is $v1.*

// Dependencies
import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
	  //other-imports
)

requestBody := graphmodels.NewPermission()
grantedToV2 := graphmodels.NewSharePointIdentitySet()
application := graphmodels.NewIdentity()
id := "89ea5c94-7736-4e25-95ad-3fa95f62b66e"
application.SetId(&id) 
grantedToV2.SetApplication(application)
requestBody.SetGrantedToV2(grantedToV2)
roles := []string {
	"write",
}
requestBody.SetRoles(roles)

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
permissions, err := graphClient.Drives().ByDriveId("drive-id").Items().ByDriveItemId("driveItem-id").Permissions().Post(context.Background(), requestBody, nil)


// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

Permission permission = new Permission();
SharePointIdentitySet grantedToV2 = new SharePointIdentitySet();
Identity application = new Identity();
application.setId("89ea5c94-7736-4e25-95ad-3fa95f62b66e");
grantedToV2.setApplication(application);
permission.setGrantedToV2(grantedToV2);
LinkedList<String> roles = new LinkedList<String>();
roles.add("write");
permission.setRoles(roles);
Permission result = graphClient.drives().byDriveId("{drive-id}").items().byDriveItemId("{driveItem-id}").permissions().post(permission);


const options = {
	authProvider,
};

const client = Client.init(options);

const permission = {
  grantedToV2: {
    application: {
      id: '89ea5c94-7736-4e25-95ad-3fa95f62b66e'
    }
  },
  roles: ['write']
};

await client.api('/drives/b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop/items/01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU/permissions')
	.post(permission);


<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\Models\Permission;
use Microsoft\Graph\Generated\Models\SharePointIdentitySet;
use Microsoft\Graph\Generated\Models\Identity;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestBody = new Permission();
$grantedToV2 = new SharePointIdentitySet();
$grantedToV2Application = new Identity();
$grantedToV2Application->setId('89ea5c94-7736-4e25-95ad-3fa95f62b66e');
$grantedToV2->setApplication($grantedToV2Application);
$requestBody->setGrantedToV2($grantedToV2);
$requestBody->setRoles(['write', 	]);

$result = $graphServiceClient->drives()->byDriveId('drive-id')->items()->byDriveItemId('driveItem-id')->permissions()->post($requestBody)->wait();


Import-Module Microsoft.Graph.Files

$params = @{
	grantedToV2 = @{
		application = @{
			id = "89ea5c94-7736-4e25-95ad-3fa95f62b66e"
		}
	}
	roles = @(
	"write"
)
}

New-MgDriveItemPermission -DriveId $driveId -DriveItemId $driveItemId -BodyParameter $params


# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.models.permission import Permission
from msgraph.generated.models.share_point_identity_set import SharePointIdentitySet
from msgraph.generated.models.identity import Identity
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Permission(
	granted_to_v2 = SharePointIdentitySet(
		application = Identity(
			id = "89ea5c94-7736-4e25-95ad-3fa95f62b66e",
		),
	),
	roles = [
		"write",
	],
)

result = await graph_client.drives.by_drive_id('drive-id').items.by_drive_item_id('driveItem-id').permissions.post(request_body)

响应

以下示例显示了相应的响应。

HTTP/1.1 201 Created
Content-Type: application/json

{
  "id": "aTowaS50fG1zLnNwLmV4dHw4OWVhNWM5NC03NzM2LTRlMjUtOTVhZC0zZmE5NWY2MmI2NmVAZDljZTBmYzEtNjFkOC00YTJlLWI1ZDMtMTg3NzBkZjA2NzJj",
  "roles": [
    "write"
  ],
  "grantedTo": {
    "application": {
      "id": "89ea5c94-7736-4e25-95ad-3fa95f62b66e",
      "displayName": "Contoso Time Manager App"
    }
  },
  "grantedToV2": {
    "application": {
      "id": "89ea5c94-7736-4e25-95ad-3fa95f62b66e",
      "displayName": "Contoso Time Manager App"
    }
  }
}

示例 2：使用 SHAREPoint Embedded 容器 ID 向 driveItem 添加 SharePoint 组权限

以下示例演示如何在由标识的 internal collaboratorsSharePoint Embedded 文件中的01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU由b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop标识的 driveItem 上添加 write sharePointGroup 的权限。

请求

以下示例显示了一个请求。

POST https://graph.microsoft.com/v1.0/drives/b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop/items/01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU/permissions
Content-Type: application/json

{
  "grantedToV2": {
    "sharePointGroup": {
      "id": "ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0"
    }
  },
  "roles": ["write"]
}


// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Models;

var requestBody = new Permission
{
	GrantedToV2 = new SharePointIdentitySet
	{
		SharePointGroup = new SharePointGroupIdentity
		{
			Id = "ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0",
		},
	},
	Roles = new List<string>
	{
		"write",
	},
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Drives["{drive-id}"].Items["{driveItem-id}"].Permissions.PostAsync(requestBody);



// Code snippets are only available for the latest major version. Current major version is $v1.*

// Dependencies
import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
	  //other-imports
)

requestBody := graphmodels.NewPermission()
grantedToV2 := graphmodels.NewSharePointIdentitySet()
sharePointGroup := graphmodels.NewSharePointGroupIdentity()
id := "ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0"
sharePointGroup.SetId(&id) 
grantedToV2.SetSharePointGroup(sharePointGroup)
requestBody.SetGrantedToV2(grantedToV2)
roles := []string {
	"write",
}
requestBody.SetRoles(roles)

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
permissions, err := graphClient.Drives().ByDriveId("drive-id").Items().ByDriveItemId("driveItem-id").Permissions().Post(context.Background(), requestBody, nil)


// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

Permission permission = new Permission();
SharePointIdentitySet grantedToV2 = new SharePointIdentitySet();
SharePointGroupIdentity sharePointGroup = new SharePointGroupIdentity();
sharePointGroup.setId("ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0");
grantedToV2.setSharePointGroup(sharePointGroup);
permission.setGrantedToV2(grantedToV2);
LinkedList<String> roles = new LinkedList<String>();
roles.add("write");
permission.setRoles(roles);
Permission result = graphClient.drives().byDriveId("{drive-id}").items().byDriveItemId("{driveItem-id}").permissions().post(permission);


const options = {
	authProvider,
};

const client = Client.init(options);

const permission = {
  grantedToV2: {
    sharePointGroup: {
      id: 'ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0'
    }
  },
  roles: ['write']
};

await client.api('/drives/b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop/items/01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU/permissions')
	.post(permission);


<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\Models\Permission;
use Microsoft\Graph\Generated\Models\SharePointIdentitySet;
use Microsoft\Graph\Generated\Models\SharePointGroupIdentity;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestBody = new Permission();
$grantedToV2 = new SharePointIdentitySet();
$grantedToV2SharePointGroup = new SharePointGroupIdentity();
$grantedToV2SharePointGroup->setId('ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0');
$grantedToV2->setSharePointGroup($grantedToV2SharePointGroup);
$requestBody->setGrantedToV2($grantedToV2);
$requestBody->setRoles(['write', 	]);

$result = $graphServiceClient->drives()->byDriveId('drive-id')->items()->byDriveItemId('driveItem-id')->permissions()->post($requestBody)->wait();


Import-Module Microsoft.Graph.Files

$params = @{
	grantedToV2 = @{
		sharePointGroup = @{
			id = "ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0"
		}
	}
	roles = @(
	"write"
)
}

New-MgDriveItemPermission -DriveId $driveId -DriveItemId $driveItemId -BodyParameter $params


# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.models.permission import Permission
from msgraph.generated.models.share_point_identity_set import SharePointIdentitySet
from msgraph.generated.models.share_point_group_identity import SharePointGroupIdentity
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Permission(
	granted_to_v2 = SharePointIdentitySet(
		share_point_group = SharePointGroupIdentity(
			id = "ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0",
		),
	),
	roles = [
		"write",
	],
)

result = await graph_client.drives.by_drive_id('drive-id').items.by_drive_item_id('driveItem-id').permissions.post(request_body)

响应

以下示例显示了相应的响应。

HTTP/1.1 201 Created
Content-Type: application/json

{
  "id": "aTowaS50fG1zLnNwLmV4dHwxMEBkOWNlMGZjMS02MWQ4LTRhMmUtYjVkMy0xODc3MGRmMDY3MmM=",
  "roles": [
    "write"
  ],
  "grantedToV2": {
    "sharePointGroup": {
      "id": "ZGYwZTEzYTgtOTExOS00MjdmLWEzNjktOTdjOWM3YjNlYjcyXzE0",
      "principalId": "10",
      "title": "Internal Collaborators"
    },
    "siteGroup": {
      "id": "10",
      "displayName": "Internal Collaborators"
    }
  },
  "grantedTo": {
    "siteGroup": {
      "id": "10",
      "displayName": "Internal Collaborators"
    }
  }
}

示例 3：使用 principalId 向 SharePoint Embedded 容器中的 driveItem 添加 SharePoint 组权限

请求

以下示例显示了一个请求。

POST https://graph.microsoft.com/v1.0/drives/b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop/items/01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU/permissions
Content-Type: application/json

{
  "grantedToV2": {
    "siteGroup": {
      "id": "10",
      "displayName": "Internal Collaborators"
    }
  },
  "roles": ["write"]
}


// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Models;

var requestBody = new Permission
{
	GrantedToV2 = new SharePointIdentitySet
	{
		SiteGroup = new SharePointIdentity
		{
			Id = "10",
			DisplayName = "Internal Collaborators",
		},
	},
	Roles = new List<string>
	{
		"write",
	},
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Drives["{drive-id}"].Items["{driveItem-id}"].Permissions.PostAsync(requestBody);



// Code snippets are only available for the latest major version. Current major version is $v1.*

// Dependencies
import (
	  "context"
	  msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
	  graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
	  //other-imports
)

requestBody := graphmodels.NewPermission()
grantedToV2 := graphmodels.NewSharePointIdentitySet()
siteGroup := graphmodels.NewSharePointIdentity()
id := "10"
siteGroup.SetId(&id) 
displayName := "Internal Collaborators"
siteGroup.SetDisplayName(&displayName) 
grantedToV2.SetSiteGroup(siteGroup)
requestBody.SetGrantedToV2(grantedToV2)
roles := []string {
	"write",
}
requestBody.SetRoles(roles)

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
permissions, err := graphClient.Drives().ByDriveId("drive-id").Items().ByDriveItemId("driveItem-id").Permissions().Post(context.Background(), requestBody, nil)


// Code snippets are only available for the latest version. Current version is 6.x

GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);

Permission permission = new Permission();
SharePointIdentitySet grantedToV2 = new SharePointIdentitySet();
SharePointIdentity siteGroup = new SharePointIdentity();
siteGroup.setId("10");
siteGroup.setDisplayName("Internal Collaborators");
grantedToV2.setSiteGroup(siteGroup);
permission.setGrantedToV2(grantedToV2);
LinkedList<String> roles = new LinkedList<String>();
roles.add("write");
permission.setRoles(roles);
Permission result = graphClient.drives().byDriveId("{drive-id}").items().byDriveItemId("{driveItem-id}").permissions().post(permission);


const options = {
	authProvider,
};

const client = Client.init(options);

const permission = {
  grantedToV2: {
    siteGroup: {
      id: '10',
      displayName: 'Internal Collaborators'
    }
  },
  roles: ['write']
};

await client.api('/drives/b!s8RqPCGh0ESQS2EYnKM0IKS3lM7GxjdAviiob7oc5pXv_0LiL-62Qq3IXyrXnEop/items/01V4EPHZNV2OJQJNBPWNCKDTXCQ5TSVBJU/permissions')
	.post(permission);


<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\Models\Permission;
use Microsoft\Graph\Generated\Models\SharePointIdentitySet;
use Microsoft\Graph\Generated\Models\SharePointIdentity;


$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);

$requestBody = new Permission();
$grantedToV2 = new SharePointIdentitySet();
$grantedToV2SiteGroup = new SharePointIdentity();
$grantedToV2SiteGroup->setId('10');
$grantedToV2SiteGroup->setDisplayName('Internal Collaborators');
$grantedToV2->setSiteGroup($grantedToV2SiteGroup);
$requestBody->setGrantedToV2($grantedToV2);
$requestBody->setRoles(['write', 	]);

$result = $graphServiceClient->drives()->byDriveId('drive-id')->items()->byDriveItemId('driveItem-id')->permissions()->post($requestBody)->wait();


Import-Module Microsoft.Graph.Files

$params = @{
	grantedToV2 = @{
		siteGroup = @{
			id = "10"
			displayName = "Internal Collaborators"
		}
	}
	roles = @(
	"write"
)
}

New-MgDriveItemPermission -DriveId $driveId -DriveItemId $driveItemId -BodyParameter $params


# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.models.permission import Permission
from msgraph.generated.models.share_point_identity_set import SharePointIdentitySet
from msgraph.generated.models.share_point_identity import SharePointIdentity
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Permission(
	granted_to_v2 = SharePointIdentitySet(
		site_group = SharePointIdentity(
			id = "10",
			display_name = "Internal Collaborators",
		),
	),
	roles = [
		"write",
	],
)

result = await graph_client.drives.by_drive_id('drive-id').items.by_drive_item_id('driveItem-id').permissions.post(request_body)

响应

以下示例显示了相应的响应。

HTTP/1.1 201 Created
Content-Type: application/json

{
  "id": "aTowaS50fG1zLnNwLmV4dHwxMEBkOWNlMGZjMS02MWQ4LTRhMmUtYjVkMy0xODc3MGRmMDY3MmM=",
  "roles": [
    "write"
  ],
  "grantedToV2": {
    "siteGroup": {
      "id": "10",
      "displayName": "Internal Collaborators"
    }
  },
  "grantedTo": {
    "siteGroup": {
      "id": "10",
      "displayName": "Internal Collaborators"
    }
  }
}

反馈

此页面是否有帮助？

Last updated on 2026-05-06

对 driveItem 创建权限

权限

HTTP 请求

请求标头

请求正文

响应

示例

示例 1：在 OneDrive 或 SharePoint Online 中向 driveItem 添加应用程序权限

请求

响应

示例 2：使用 SHAREPoint Embedded 容器 ID 向 driveItem 添加 SharePoint 组权限

请求

响应

示例 3：使用 principalId 向 SharePoint Embedded 容器中的 driveItem 添加 SharePoint 组权限

请求

响应

反馈

其他资源