Member.Read.Hidden | Graph Permissions

Permission Details

Application Permission

Read all hidden memberships

Allows the app to read the memberships of hidden groups and administrative units without a signed-in user.

Permission ID: 658aa5d8-239f-45c4-aa12-864f4fc7e490

Delegated Permission

Read hidden memberships

Allows the app to read the memberships of hidden groups and administrative units on behalf of the signed-in user, for those hidden groups and administrative units that the signed-in user has access to.

Permission ID: f6a3db3e-f7e8-4ed2-a414-557c8c9830be

Properties

Microsoft Graph beta exact-category-docs

Properties is shown from beta metadata because a stable v1.0 schema is not available for this resource mapping.

Property	Type	Description
`contactId`	`String`	The ID of the referenced contact, if applicable. Optional.
`displayName`	`String`	The display name of the member. Optional.
`key`	`String`	The email address or routing key of the member. Required.
`recipientType`	`recipientType`	The type of the recipient. The possible values are: contact, oneOff, mailbox, privateDL, unknownFutureValue. Optional.
`routingType`	`String`	The routing type for the member, for example, SMTP. Optional.

JSON Representation

Microsoft Graph beta exact-category-docs

JSON representation is shown from beta metadata because a stable v1.0 schema is not available for this resource mapping.

JSON representation

{
  "@odata.type": "#microsoft.graph.member",
  "contactId": "string",
  "displayName": "string",
  "key": "string",
  "recipientType": "string",
  "routingType": "string"
}

Relationships

Relationships metadata is not available for this permission mapping.

View resource documentation

Graph Methods

Delegated access App-only access

Exact Microsoft Learn match

Microsoft Graph v1.0 endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET `/education/classes/{id}/members`
POST `/education/classes/{id}/members/$ref`

Exact Microsoft Learn match

Microsoft Graph beta endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET `/education/classes/{id}/members`
POST `/education/classes/{id}/members/$ref`

Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell v1.0 commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
`Get-MgEducationClassMember` /education/classes/{id}/members List members of an educationClass
`New-MgEducationClassMemberByRef` /education/classes/{id}/members/$ref Add a student

Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell beta commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
`Get-MgBetaEducationClassMember` /education/classes/{id}/members List members
`New-MgBetaEducationClassMemberByRef` /education/classes/{id}/members/$ref Add a student

Code Examples

C# / .NET SDK

Add a student

View official example on Microsoft Learn

// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Models;

var requestBody = new ReferenceCreate
{
	OdataId = "https://graph.microsoft.com/v1.0/education/users/13015",
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
await graphClient.Education.Classes["{educationClass-id}"].Members.Ref.PostAsync(requestBody);

JavaScript

Add a student

View official example on Microsoft Learn

const options = {
	authProvider,
};

const client = Client.init(options);

const educationUser = {
  '@odata.id':'https://graph.microsoft.com/v1.0/education/users/13015'
};

await client.api('/education/classes/{class-id}/members/$ref')
	.post(educationUser);

PowerShell

Add a student

View official example on Microsoft Learn

Import-Module Microsoft.Graph.Education

$params = @{
	"@odata.id" = "https://graph.microsoft.com/v1.0/education/users/13015"
}

New-MgEducationClassMemberByRef -EducationClassId $educationClassId -BodyParameter $params

Python

Add a student

View official example on Microsoft Learn

# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.models.reference_create import ReferenceCreate
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = ReferenceCreate(
	odata_id = "https://graph.microsoft.com/v1.0/education/users/13015",
)

await graph_client.education.classes.by_education_class_id('educationClass-id').members.ref.post(request_body)

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Application permissions or delegated permissions and search for Member.Read.Hidden

4

Grant Admin Consent

Application permissions always require admin consent.

Frequently asked questions

What is the Member.Read.Hidden Microsoft Graph permission?

Member.Read.Hidden is available as both an application permission and a delegated permission in the Microsoft Graph API, grouped under the Member category. Allows the app to read the memberships of hidden groups and administrative units without a signed-in user. It grants read-only access to resources. Application permissions always require admin consent. It is mapped to the Microsoft Graph member resource type. 4 documented Microsoft Graph REST methods require it. 4 Microsoft Graph PowerShell commands are documented for it.

Is Member.Read.Hidden an application or a delegated permission?

Member.Read.Hidden is available as both an application permission (app-only access, no signed-in user) and a delegated permission (access on behalf of a signed-in user).

Does Member.Read.Hidden require admin consent?

Application permissions always require admin consent.

What is the permission ID (GUID) for Member.Read.Hidden?

For Member.Read.Hidden, the application (app role) ID is 658aa5d8-239f-45c4-aa12-864f4fc7e490, and the delegated (OAuth2 scope) ID is f6a3db3e-f7e8-4ed2-a414-557c8c9830be. These are the real Microsoft Graph identifiers and can be used directly in an app registration manifest.