I need to create a new RoleDefinition and apply it to a group. Is that possible? How can I do that?


Yes that is possible. You need to use CSOM. Look at this example:

Write-Host "Opening $tenancySiteCollectionUrl ... " -NoNewLine
$ctx = New-Object Microsoft.SharePoint.Client.ClientContext($tenancySiteCollectionUrl)
$ctx.Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($Username, $securePassword)

$web = $ctx.Web

Write-Host "OK" -ForegroundColor Green -BackgroundColor Black

Write-Host "Creating the 'Contribute - No Deletion' RoleDefinition ... " -NoNewLine
$permissions = New-Object "Microsoft.SharePoint.Client.BasePermissions"

$roleDefinitionCreationInfo = New-Object "Microsoft.SharePoint.Client.RoleDefinitionCreationInformation"
$roleDefinitionCreationInfo.Name = "$roleDefinitionName"
$roleDefinitionCreationInfo.Description = "Can view, add, and update list items and documents"
$roleDefinitionCreationInfo.BasePermissions = $permissions

    Write-Host "Done" -ForegroundColor Green -BackgroundColor Black
Catch [system.exception]
    Write-Error $ex

Then you need to modify your existing group in this way:

    New-SPOSiteGroup "$($tenancySiteCollectionUrl)" -Group "$($groupName)" -PermissionLevels "Contribute"

you can also use the powershell to create the same thing

$web = Get-SPWeb http://dmg-10
$permname = "PermName1"

#create role def
$roledef = New-Object Microsoft.SharePoint.SPRoleDefinition
$roledef.BasePermissions = [Microsoft.SharePoint.SPBasePermissions]::FullMask -bxor [Microsoft.SharePoint.SPBasePermissions]::ManageSubwebs
#[enum]::GetValues([Microsoft.SharePoint.SPRights]) | ?{$_.value__ -band $roledef.BasePermissions}

$roledef.Name = $permname

#remove other role assignments (ie. Full Control)

#assign role def to group
$roledef = $web.RoleDefinitions[$permname]
$roleassign = new-object Microsoft.SharePoint.SPRoleAssignment($web.AssociatedOwnerGroup)

Source: http://www.gbois.com/view/5/PowerShell-SharePoint-Creating-Role-Definition-and-Applying-to-a-Group

  • does that work on SP Online?
    – Gaetanu
    May 20 '14 at 14:52
  • @Gaetanu no that would'nt work on SP Online. You need to use CSOM in conjunction with PowerShell SP Online cmdlet. Nov 12 '15 at 11:48

You could also use


To create the RoleDefinition and New-SPOGroup if you want to create a group with that RoleDefinition.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.