I would like to remove the contribute permission level from a specific group. I use this code:

Group group1 = web.SiteGroups.GetByName("StudentsKls11"); 
            RoleDefinition readDef = context.Web.RoleDefinitions.GetByName("Contribute"); 
            RoleDefinitionBindingCollection roleDefCollection = new RoleDefinitionBindingCollection(context);
            RoleAssignment newRoleAssignment = context.Web.RoleAssignments.Add(group1, roleDefCollection);


I get this error message:

An unhandled exception of type 'Microsoft.SharePoint.Client.ServerException' occurred in Microsoft.SharePoint.Client.Runtime.dll Additional information: Cannot add a role assignment with empty role definition binding collection.

It works fine for adding permission levels to groups, then I would change: roleDefCollection.Remove(readDef); with: roleDefCollection.Add(readDef);

Any thoughts?


In order to remove a permission level from a group, you must remove the role definition from the assignment pertaining to that group from the Web. Try this:

    web => web.SiteGroups.Include(
        g => g.Title,
        g => g.Id ),
    web => web.RoleAssignments.Include(
        assignment => assignment.PrincipalId,
        assignment => assignment.RoleDefinitionBindings.Include(
            definition => definition.Name ) ),
    web => web.RoleDefinitions.Include(
        definition => definition.Name ) );


var readDef = clientContext.Web.RoleDefinitions.FirstOrDefault( 
        definition => definition.Name == "Contribute" );
var group = clientContext.Web.SiteGroups.FirstOrDefault( 
        g => g.Title == "StudentsKls11" );
if ( readDef == null || group == null ) return;

foreach ( var rd in from roleAssignment in clientContext.Web.RoleAssignments
                    where roleAssignment.PrincipalId == @group.Id
                    from rd in roleAssignment.RoleDefinitionBindings.Where( 
                        rd => rd.Name == readDef.Name )
                    select rd ) {

Requires the following directives:

using System.Linq;
using Microsoft.SharePoint.Client;
  • Unfortunately it doesnt work for me. Isnt there a more simple way to remove a role? – Jacob Filtenborg Aug 25 '14 at 9:02
  • Where does it fail? I did this off the top of my head, I may have made a mistake. – wjervis Aug 25 '14 at 11:20
  • It fails at var readDef = context.Web.RoleDefinitions.FirstOrDefault With error: 'Microsoft.Sharepoitn.Client.RoleDefinitionCollection' does not contain a definition for 'FirstOrDefault' and no exstension method 'FirstOrDefault* accepting a first argument of type 'Microsoft.Sharepoitn.Client.RoleDefinitionCollection' could be found (are you missing a using directive or an assembly reference?) – Jacob Filtenborg Aug 25 '14 at 13:16
  • Do you have the System.Linq using directive? I'll add all of my directives to the answer. – wjervis Aug 25 '14 at 13:23
  • I get the following error while trying to remove a permission from an SP Group using RoleDefinitionBindingCollection.remove. Does the remove function not work using Javascript? Unable to get property 'remove' of undefined or null reference – Manu Jul 27 '15 at 14:23

Little bit late to the party but here's my take on it if someone else stumbles on to this thread.

It seems they have removed the Remove method on RoleAssignment for the client API:s. The code below assumes you have the Group and Web objects already. The code below demonstrates how to add a group and then remove it using client C# API.

        ctx.Load(web, w => w.HasUniqueRoleAssignments, w =>  w.RoleAssignments, 
        w => w.RoleDefinitions);


        var contributeRoleDef = web.RoleDefinitions.GetByType(RoleType.Contributor);
        var roleDefBindColl = new RoleDefinitionBindingCollection(ctx);

       // add new group 
       web.RoleAssignments.Add(grp, roleDefBindColl);

       // since they removed the web.RoleAssignments.Remove method
       // we use this to remove the group instead


If you want to break inheritance on a web for example use BreakRoleInheritance(false, true). First bool is to determine if u want to clear the current inheritance and the second is determining if you want to clear subscopes.

       // check if web already have unique role assignments if not we break
       // break permissions and add our group in the break.

       if (!web.HasUniqueRoleAssignments)
           // break inheritance
           web.BreakRoleInheritance(false, true);
           // add group as before
           web.RoleAssignments.Add(grp, roleDefBindColl);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.