Using CSOM and C#, how can I get the groups that have permissions on a site along with their roles, given that I have the name of the subsite?

Language might be a barrier here, and I tend to explain things more difficult than they really are. So. To get a visual idea of what I'm trying to achieve, please just do the following:
While on a SharePoint site (any site, doesn't matter if it is the top site level or a subsite) on which you have administrator rights, click on the settings icon at the top right and choose "Shared with...". Then click on "Advanced".
You then see a list of groups and their roles (like "Edit", "Read", "Contribute" and so on).
That is what I am trying to retrieve using C#. A list that shows just that.

So far I managed to get a nice list of all groups in a subsite along with their roles, but the list also shows me the groups for each and every page library, document library and list library in the subsite. Basically it shows me all the groups, from all underlaying libraries. And that's not the result I was searching for.
So if there is a way to get the groups for each individual subsite, if possible even for each individual library (because I'll be needing that in the future), then that would be greatly appreciated.

Thanks in advance for your time!

In reply to Brandon C., I adapted your code to this:

if (web.HasUniqueRoleAssignments)
   RoleAssignmentCollection rCol = web.RoleAssignments;
   foreach (RoleAssignment rAssign in rCol)
      Console.WriteLine(rAssign.Member + " - " + rAssign.RoleDefinitionBindings);

However in the console I then get this for each role assignment in the role assignment collection:

Microsoft.SharePoint.Client.Principal - Microsoft.SharePoint.Client.RoleDefinitionBindingCollection

2 Answers 2


Try this

            var ogroup = context.Web.AssociatedOwnerGroup;
            var mgroup = context.Web.AssociatedMemberGroup;
            var vgroup = context.Web.AssociatedVisitorGroup;


            var currentWebGroups = new List<string>() {ogroup.LoginName, mgroup.LoginName, vgroup.LoginName};

            var assignments = context.Web.RoleAssignments;
            context.Load(assignments, assignment => assignment.Include(role => role.Member, role => role.RoleDefinitionBindings));

            foreach (var roleAssignment in assignments.Where(assignment => currentWebGroups.Contains(assignment.Member.LoginName)))
                Console.WriteLine(roleAssignment.Member.LoginName + " - " + roleAssignment.RoleDefinitionBindings.First().Name);
  • That also just returns "Microsoft.SharePoint.Client.Principal - Microsoft.SharePoint.Client.RoleDefinitionBindingCollection" in the console.
    – Magali
    Commented Jun 16, 2014 at 10:12
  • Are you sure? I have tested this code in my environment this works OK.
    – Roman
    Commented Jun 16, 2014 at 11:12
  • I assigned roleAssignment.Member.LoginName to a variable and now it does, sorry for the misunderstanding! Still showing all groups from all child elements as well though.
    – Magali
    Commented Jun 16, 2014 at 11:17
  • I little bit changed own code and added to this getting and filtering VisitorGroup,MembersGroup and OwnersGroup
    – Roman
    Commented Jun 16, 2014 at 13:25
  • I think that it's context.Web.AssociatedOwnerGroup that should be assigned to ogroup. But I now get a new error: "Object reference is not set to an instance of an object on server. The object is associated with property AssociatedVisitorGroup." on the line where you assign the groups to currentWebGroups.
    – Magali
    Commented Jun 17, 2014 at 12:06

I believe I answered a question of yours earlier that was similar to this, so if what I am posting is pretty much te same and wrong, just let me know :)

It should work with this, right?

Change the write-host to whatever you want to store the string as, or something

Try doing it this way then? I don't have a way to write the code, so I have no way of checking if my stuff is correct, so take it at face value :)

   SPRoleAssignmentsCollection myRoleCollection = list.RoleAssignments;
   foreach (SPRoleAssignment myRole in myRoleCollection)  {

      write-host myRole.Member.Name " - ";
      foreach (SPRoleDefinition roleDefinition in myRoleCollection.RoleDefinitionBindings)
         write-host roleDefinition.Name ", ";

I'm having a little trouble figuring out how to get the role name printed, but that'll print every group in the subsite I think.

  • It is a bit similar yes but the questions aren't the same. In the previous question I needed to find how to get the groups and their roles from a subsite, but I didn't held in account it would also give me the groups and roles of all the child elements of the subsite. So hence the reason why I posted a new question, this time to figure out how to get groups for just the subsite and not the child elements. :) I'll try out your code again!
    – Magali
    Commented Jun 16, 2014 at 9:36
  • I adapted your code but I can't seem to get details on the member of the role assignment, and I couldn't add Role so I added RoleDefinitionBindings instead.
    – Magali
    Commented Jun 16, 2014 at 9:43
  • Now I'm not an expert at Powershell and c# script, but I took a look at your previous code from the question I answered last, and I think I see your problem. You include the line foreach (Group g2 in o1), and then check roles based on that. I think in that way, it will show roles by group for everything they are a part of, not just for the current web you are looking at.
    – Brandon C.
    Commented Jun 16, 2014 at 9:43
  • I'm not using Powershell actually, just C#. And indeed in my previous question I did loop through the groups in the collection and that is indeed why I get all the groups, but I couldn't figure out to get a list of only the groups on the subsite, without including all the groups from the child elements.
    – Magali
    Commented Jun 16, 2014 at 9:44
  • Try using my second code. If that doesn't do it, then I have no idea :\
    – Brandon C.
    Commented Jun 16, 2014 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.