Compare SharePoint group members for auto-approvals with Power Automate

Many processes are built to go through approvals using (M365/SPO) groups for the usual “Assigned To” field. And we all know that you can go through maaaany approvers 😅. Today’s post is about approving a request (and moving to the next stage) if at least one SharePoint group member is the same as the previous approvers.

Setup

I have a simple list called Requests with the following fields:

• Title
• Approver 1
• Approver 2
• Approval Status

Approver 1 & Approver 2 are people fields where groups are allowed.

When it comes to SPO groups, I have 2 groups:

• Group1 Test (only myself in the group)
• Group2 Test (myself and John Smith as members)

Flows

You’re likely to have a Power Apps or external system create the SharePoint item, and your first flow would go through sending an email or assigning a task to Approver1 (and/or whatever else need to be done for your process).

Now, the next flow is the one we’re interested in for today 😉

In our scenario, when there’s an approval from Approver 1, the Approval Status will be updated, and that’ll start our next flow to compare if a member of the SharePoint group (in Approver 2) was also in the SharePoint group for Approver 1.

Our trigger will be “When an item or file is modified“, and then:

1. Get request details
2. Compare members
3. Auto-approved or send email to Approver 2

Alright, let’s go! 🚀

Variables needed

We need to do the comparison either with the Email for each member, or the Claims. Personally, I like to choose the Claims because we don’t need to do any type of modification (aka use toLower() function).

So let’s initialise array variables:

• varApprover1Claims
• varApprover2Claims

The next step is to get the request details and the Approver2 (group) details. I’ll use an HTTP request to SharePoint to obtain the group details.

Approver2 group details

The SPO group details outputs will give us the below information:

    "Id": 23,
    "IsHiddenInUI": false,
    "LoginName": "Group2 Test",
    "Title": "Group2 Test",
    "PrincipalType": 8,
    "AllowMembersEditMembership": false,
    "AllowRequestToJoinLeave": false,
    "AutoAcceptRequestToJoinLeave": false,
    "Description": "",
    "OnlyAllowMembersViewMembership": true,
    "OwnerTitle": "Veronique Lengelle",
    "RequestToJoinLeaveEmailSetting": null

And as you can see, we’ve got nothing regarding the members. BUT that can be useful to update the Approval Status field with the name of the group. If you’re not interested in this output, you can remove it 🙂

However, from the outputs of SPO group member action, we’ll get the “LoginName” which will be the Claims.

"LoginName": "i:0#.f|membership|jsmith@MyDomain.onmicrosoft.com"

"LoginName": "i:0#.f|membership|vero@MyDomain.onmicrosoft.com"

So let’s append our varApprover2Claims variable with this value:

Approver1 group details

We need to do the same thing to get information about Approver1. So we’ll repeat the same steps.

Comparison

Now that we’ve got both arrays, let’s compare them. We’ll use a Filter Array action as follows:

• The From value will be varApprover1Claims
• The left hand side of the condition will be varApprover2Claims
• The operator will be contains
• The right hand side will be item()

@contains(variables('varApprover2Claims'), item())

Results

After adding a condition below (likely for most scenarios!), we’ll branch out depending on the length of the array.

If the length of the array is greater than zero, it means we have a member in Approver2 who was in the Approver1 group😉 And looking at the Setup above, we should!

length(body('Compare_Approver1_and_Approver2_members'))

If I remove myself from Approver1, and add another user instead (who’s not John Smith), the array will be empty:

Thanks for reading! 🙂