Non-admin user can add permission to other user but not able to update/delete the permission on sharepoint onedrive item

Question

I am a member (not owner) of an office 365 public group. I am able to give permission to any external user on any onedrive item in sharepoint but when I try to update the permission or delete the permission it returns the following response with 403 (forbidden) status code:-

{
    "error": {
        "code": "accessDenied",
        "message": "The caller does not have permission to perform the action.",
        "innerError": {
              "request-id": "96e96666-b368-41f6-ad27-6a45ecc69410",
              date: "2018-02-20T11:49:33"
        }
    }
}

Is this a correct behavior or a bug?

Answer 1

This is by design. The user needs ‘Manage Permission’ rights to be able to update/delete permissions and typically its granted only to admins.

The fact that the non-admin user can add permission(share) is governed by the Web Property commonly referred to as ‘Members Can Share’, which is typically left ON.