SharePoint / SharePoint/sp-dev-docs

GetChanges API does not report RoleAssignmentDelete for folders when inherited permission is removed from parent library/folder

Open
#10,405 4 comments 1 reaction 2 assignees View on GitHub

@VesaJuvonen is already working on this.

Since Oct 28, 2025.

area:docs sharepoint-developer-support type:bug-suspected
Dominant language
PowerShell
Stars
1.4k
Forks
1.1k
Avg merge
4d 12h
Merged PRs (30d)
12

Description

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

SharePoint REST API

Developer environment

None

What browser(s) / client(s) have you tested
  • 💥 Internet Explorer
  • 💥 Microsoft Edge
  • 💥 Google Chrome
  • 💥 FireFox
  • 💥 Safari
  • mobile (iOS/iPadOS)
  • mobile (Android)
  • not applicable
  • other (enter in the "Additional environment details" area below)
Additional environment details

Request is done using Application Permissions

Describe the bug / error

When using the SharePoint GetChanges API at the list scope, I observed the following behavior:

Adding unique role assignments to a parent folder or document library automatically applies the same permission to child folders (if the child folder has broken role inheritance). This addition is correctly reported as RoleAssignmentAdd in the GetChanges API for child folder.

Removing those permissions from the parent also removes the permission from the child folder, but GetChanges does not report a RoleAssignmentDelete for the child folder.

Example:
https:///sites/mysite/_api/web/lists/GetById('driveId')/GetChanges
query:

{
  "ChangeTokenStart": { "StringValue": "<start_of_token>" },
  "ChangeTokenEnd": { "StringValue": "<end_of_token>" },
  "Update": true,
  "DeleteObject": true,
  "Move": true,
  "Restore": true,
  "RecursiveAll": true,
  "SystemUpdate": true,
  "Add": true,
  "Rename": true,
  "Item": true,
  "RoleAssignmentAdd": true,
  "RoleAssignmentDelete": true
}
Steps to reproduce
  1. Create a folder inside the document library and break inheritance to give it unique role assignments.
  2. Add a unique role assignment to the document library.
  3. Call GetChanges at the list scope and verify that for the folder RoleAssignmentAdd ChangeType is present
  4. Remove the previously added role assignment from the document library.
  5. Call GetChanges again at the list scope.

Actual Result:

The folder no longer has the inherited permission, but no RoleAssignmentDelete or any other change is returned.

Expected behavior

The folder should have a RoleAssignmentDelete change returned by the API, reflecting that the permission was removed.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.