Hi,

This request is related to https://microsoftgraph.uservoice.com/forums/920506-microsoft-graph-feature-requests/suggestions/36578248-add-group-members-owners-delta-link, unfortunately it has been closed with no resolution.

The first option you suggested on that request:
https://graph.microsoft.com/v1.0/groups/delta?$select=id&$expand=members

includes the members array, exposing for each member ONLY the id, so, we don't know if every single member is an owner, a member, not even his userPrincipalName or displayName.
This way we are REQUIRED to get members by invoking an api for each single group, this way the delta link power is completely useless.

The sample response is:
"id": "1e770bc2-3c5f-487f-871f-16fbdf1c8ed8",
"members@delta": [
{
"@odata.type": "#microsoft.graph.user",
"id": "8b209ac8-08ff-4ef1-896d-3b9fde0bbf04"
}

The second option you suggested:
https://graph.microsoft.com/v1.0/groups/delta?$select=id&$expand=members

is not working at all. But if it would have worked, we are required to invoke an api for every single group to get members info other than id.

Actually these are the main differences I would to spot on:

1) Getting Groups WITHOUT delta (eg. https://graph.microsoft.com/v1.0/groups/?$expand=members):
{
"id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
"deletedDateTime": null,
"classification": null,
"createdDateTime": "2017-07-31T18:56:16Z",
"creationOptions": [
"ExchangeProvisioningFlags:481"
],
"description": "Welcome to the HR Taskforce team.",
"displayName": "HR Taskforce",
"groupTypes": [
"Unified"
],
"members": [
{
"@odata.type": "#microsoft.graph.user",
"id": "4782e723-f4f4-4af3-a76e-25e3bab0d896",
"deletedDateTime": null,
"accountEnabled": true,
"ageGroup": null,
"businessPhones": [
"+1 858 555 0110"
],
"city": "San Diego",
............

1) Getting Groups WITH delta (eg. https://graph.microsoft.com/v1.0/groups/delta?$expand=members):
{
"id": "02bd9fd6-8f93-4758-87c3-1fb73740a315",
"deletedDateTime": null,
"classification": null,
"createdDateTime": "2017-07-31T18:56:16Z",
"creationOptions": [
"ExchangeProvisioningFlags:481"
],
"description": "Welcome to the HR Taskforce team.",
"displayName": "HR Taskforce",
"groupTypes": [
"Unified"
],
members@delta": [
{
"@odata.type": "#microsoft.graph.user",
"id": "4782e723-f4f4-4af3-a76e-25e3bab0d896"
}

Could we have a members@delta properties enrichment by exposing the UserprincipalName, DisplayName and isOwner?

Thank you

Applications that implement group based authorization require the ability to query the group identifiers of the signed in user via minimal delegated permissions. The group based authorization is a common scenario for (multi-tenant) SaaS applications. Oftentimes it's difficult or impossible to get permissions from a customer that can expose a broad set of information. Even if one was able to get the permissions, the implementation would still be sub-optimal and cause unnecessary security risks.

The current version of user: getMemberGroups function doesn't satisfy the need because it requires broad and even application level permissions.
https://docs.microsoft.com/en-us/graph/api/user-getmembergroups?view=graph-rest-1.0&tabs=cs

Please note that the above document is out of date and inaccurate regarding the required permissions.
https://github.com/microsoftgraph/microsoft-graph-docs/issues/3938

Please implement support for the operation of querying group identifiers of the signed in user with appropriate minimal delegated permissions (such as User.Read).

Nowadays it's needed to make a group owner also a group member in at least the following cases:
- List group plans
- Create group plan

When you're provisioning groups via code, a very common provisioning scenario, the 'creator' is only added as owner to the group and not as a member. Via the UI you first have to add someone as a member before 'promoting' him/her to an owner. In that case the user will be both owner and member.

We cannot see the functional need to also add an owner as a member, so we guess it's a technical/design choice.

Maybe it is possible to have some kind of 'Groups Administrator' or 'Groups service' role in O365 to be able to get/manage all groups and underlying endpoints?

Once I was assigned the "Application Developer" Azure AD role I could no longer issue requests where I set myself as owner of a group when creating it. I consider this to be broken as implicit behavior based on role assignment affect the format of my requests to the Graph API!

Failing request:
{
"displayName": "My group",
"mailEnabled": false,
"mailNickname": "undefined",
"securityEnabled": true,
"owners@odata.bind": [
"https://graph.microsoft.com/v1.0/users/<id of myself>"
]
}

Response:
{
"error": {
"code": "Request_BadRequest",
"message": "Request contains a property with duplicate values.",
"innerError": {
"request-id": "aae9881c-570e-4443-9ce7-a4ca87889d9e",
"date": "2019-10-02T13:06:59"
}
}
}

Successful request:
{
"displayName": "My group",
"mailEnabled": false,
"mailNickname": "undefined",
"securityEnabled": true
}

This time the group was created and I was set as owner anyway based on my "Application Developer" role.