SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a SPListItem for which I need to transfer all directly given permissions from Alice to Bob. It sounds like a common scenario, but still I was not able to find a solution (except third party tools).

The closest I got is using SPSecurableObject.GetUserEffectivePermissionInfo method to retrieve object permissions for Alice:

SPListItem item = getListItem(); 

var pi = item.GetUserEffectivePermissionInfo(@"domain\alice");

foreach (SPRoleAssignment ra in pi.RoleAssignments)
    foreach (SPRoleDefinition rd in ra.RoleDefinitionBindings)
        Console.WriteLine("\t{0}", rd.Name);

However, this is suboptimal, since I am actually not interested in "effective" permissions. With code snippet above, permissions given thru groups are also listed. I need to find a way how to filter out only directly given permissions, I would expect a separate method for that, but I haven't found anything. Am I just blind?

share|improve this question
So you are assigning users permissions directly and not defining groups? An easier way would of been to create groups and just work with groups. Wouldn't it? – Hugh Wood Nov 27 '12 at 9:48
Agreed, but this is how it was implemented. Now I need to replace an employee who is leaving the company with a new joiner, no time for major redesign. There are thousands of documents with unique permissions. – Michal Klouda Nov 27 '12 at 10:04
up vote 1 down vote accepted


You can do like:

 SPRoleDefinitionBindingCollection reqRoleDef;
 foreach (SPRoleAssignment assign in itemRecomm.RoleAssignments)
     if (assign.Member is SPUser)
         SPUser user = assign.Member as SPUser;
         if (user.LoginName == @"Domain\alice")
             reqRoleDef = assign.RoleDefinitionBindings;

Or even in your code snippet, check what does RoleAssignment.Member returns? Is it a SPGroup or SPUser, if it return SPGroup for group permissions then you can simply ignore SPGroup one's and take SPUser Role Bindings!

I hope this helps

share|improve this answer
This looks promising, I will check it later today and will let you know (accept your answer). Thank you very much! – Michal Klouda Nov 27 '12 at 10:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.