BreakRoleInheritance and Inherit Permissions ListItem

Question

I'm having a little difficulty with the BreakRoleInheritance in keeping inheritance of permissions in a users OneDrive for Business Documents list. By default the users Documents list has two Permissions levels already assigned. The user with "Full Control" and Everyone except external users with "Read"

This is an example of the structure I'm testing:

• Folder 1 is assigned unique permissions with "Contribute" as I don't want to copy the parent permissions. User the following to achieve this listItem.BreakRoleInheritance(false, false);
• Folder 2 should inherit permissions from Folder 1 and then Folder 3 inherit permissions from Folder 2. I'm trying to use this for Folder 2 and Folder 3 listItem.BreakRoleInheritance(true, true);

My understanding for BreakRoleInheritance.

[Remote]
    public virtual void BreakRoleInheritance(bool copyRoleAssignments, bool clearSubscopes);

The first parameter "copyRoleAssignments" copies the RoleAssignments from the parent securable object. So setting to true should copy and false allows me to assign unique permissions. I'm not sure if I am setting the second parameter correctly. I have tried True and False and still the same outcome. To check the permissions for "Folder 2" I see the following in the UI, it should inherit the permissions not have unique values.

I use the below to get the ListItem :

if (BreakRoleInheritance) {
    listItem.BreakRoleInheritance(false, false);
} else {
    listItem.BreakRoleInheritance(true, true);
}
if (ItemPermissions.Count() > 0) {
    foreach (ItemPermission item in ItemPermissions) {
           RoleDefinition roleDefinition = clientContext.Site.RootWeb.RoleDefinitions.GetByName(item.RoleDef.ToString());
           RoleDefinitionBindingCollection roleBindings = new RoleDefinitionBindingCollection(clientContext) { roleDefinition };
           Principal user = clientContext.Web.SiteUsers.GetById(item.PrincipalId);
           listItem.RoleAssignments.Add(user, roleBindings);
     } } 



listItem.Update();clientContext.ExecuteQuery();

I'm not sure what I am missing.

When I step through the code and check the roles and permissions through the UI I can see that Folder 2 has inherited the permissions before the ExecuteQuery(). Once it executes the query it assigns the unique permissions.

Also when running the above code on Folder 2 and Folder 3 ItemPermissions.Count() is 0 so the code with in this if statement is never executed. Only the below is executed.

listItem.BreakRoleInheritance(true, true);

Answer 1

Using listItem.BreakRoleInheritance(false, false); to break inheritance for Folder1 is correct, if you want to have unique permissions set from this level on. But if you want Folder2 to inherit from Folder1 and Folder3 from Folder2 (which basically means both inherit from Folder1) you CANNOT use BreakRoleInheritance. This will break inheritance of permissions those they have to be set manually.

listItem.BreakRoleInheritance(true) would break inheritance while copying all existing permissions the listItem. If you do this for Folder2 you will never get any changes made to permissions for Folder1.

If you want to inherite permissions from the parent element, you don't have to do anything as this is the Default Way in SharePoint.

For the Folders I suggest start using list.RootFolder.Folders (if you're using CSOM) to navigate through your folders. folder.Item gives you the ListItem which can be used to break or inherite permissions.

If I got it all wrong, please let me know.