[SharePoint Online] Migrate DLS from REST API to Graph API using M365 group membership

[kmitul]

Problem Description

Post-ACS retirement, the connector's DLS depends on three REST API calls that fail with Unsupported app only token under Entra client-credential auth:

• site_role_assignments() — /_api/web/roleassignments
• site_admins() — /_api/web/SiteUsers?$filter=isSiteAdmin eq true
• site_groups_users() — /_api/web/sitegroups/getbyid({id})/users

Drive item fetching and permission retrieval already use Graph API. Only the DLS resolution layer is broken.

Proposed Solution

Replace the three REST API DLS calls with M365 group membership lookups via Graph API.

SharePoint Team sites are backed by M365 groups. Instead of querying REST API role assignments, resolve the site's M365 group ID and use existing Graph endpoints:

• _site_access_control() → GET /groups/{id}/owners (site admins) + GET /groups/{id}/members (site members)
• siteGroup expansion in _with_drive_item_permissions() → map siteGroup to M365 group, expand via same endpoints

M365 group ID resolved with 3-tier fallback: site.group.id → site.groupId → GET /groups?$filter=mailNickname eq '{siteName}'.

Communication sites (no M365 group) fall back to empty site-level ACL — item-level permissions still work independently.

Page/list/item unique role assignments have no Graph equivalent — those stay on REST API wrapped with PermissionsMissing fallbacks.

Required scopes: Sites.Read.All (existing) + GroupMember.Read.All (new)

Alternatives

• GET /sites/{id}/permissions — returns app-level grants, not user-level access. Would also need a broader scope than GroupMember.Read.All.
• Keep REST API with cert auth — inconsistent across tenants, not a reliable long-term path.

Additional Context

Related: #3293, #3023, PR #3064

Verified locally — sync completes with DLS enabled, owners/members resolve correctly. Happy to submit a PR.