First of all we need to understand what MS calls `Permissions` over their API, to quote them:

> The **Permission** resource provides information about a sharing permission granted for a [DriveItem](https://learn.microsoft.com/en-us/graph/api/resources/driveitem?view=graph-rest-1.0) resource.
>
> Sharing permissions have many different forms. The **permission** resource represents these different forms through facets on the resource.

Sharing Permissions can be one of: `read`, `write` or `owner`. While those gives "access" to the file/folder it isn't exactly access control, as someone who has access to the relevant `Document Library` (i.e. `drive resource`) can see the folder/file normally.

Actual user access control is made thru Sharepoint Site Group, and that's site wide. It is possible to make make folders not inherit the site permissions but this implies steps to be taken by the Sharepoint Admin.

Begin of the insertionIn orderEnd of the insertion Begin of the deletion The API allows for adding and removing usersEnd of the deletion to Begin of the insertionmakeEnd of the insertion a Begin of the insertionFolder/Document Library not inheritEnd of the insertion Begin of the deletion `Group` butEnd of the deletion the permissions Begin of the insertionSite Admin action isEnd of the insertion required Begin of the insertionin order to make it so, and it isn't considered a good practice as this creates "granular permissions" a increase the burden on admins.

We can add/remove users to the Site group, the applicationEnd of the insertion would Begin of the insertionneedEnd of the insertion Begin of the deletion give usEnd of the deletion a Begin of the deletion lot of power over their Entra/Directory (namelyEnd of the deletion `GroupMember.ReadWrite.All` and Begin of the insertion`User.ReadWrite.All`. These application permissions would apply to the whole tenantEnd of the insertion Begin of the deletion `User.ReadWrite.All`End of the deletion and Begin of the insertionall `Groups`. (**Note:** It is worth of noting that there's a possibility of synchronization with a on premises Active Directory)

Note that we can't (as in there's no API at all for):
1\. Create a Site
2\. Edit the ACL for folders or Document Libraries in order to make then not inherit the permissions.
3\. Probably other details :PEnd of the insertion Begin of the deletion very possibly `Directory.ReadWrite.All`)

<TO BE CONTINUED>End of the deletion