I am trying to add read-only-permissions to a specific group called "Students" for a list I have created called "Quiz". I have to use PowerShell CSOM, and in every other tutorial I've been through, .NET server types have been used.


$ListName = "Quiz"
$PermissionLevel = "Read Only"
$web = $ctx.Web        

$lists = $web.Lists
foreach($list in $lists)
    if($list.Title -eq $ListName)
        $listId = $list.Id
$list = $lists.GetById($listId)

Write-Host "List:" $List.Title -foregroundcolor Green
if ($list -ne $null)
    $groups = $web.SiteGroups
    foreach ($SiteGroup in $groups) {                    
        if ($SiteGroup.Title -match "Students")
            write-host "Group:" $SiteGroup.Title -foregroundcolor Green
            $GroupName = $SiteGroup.Title

            $builtInRole = $ctx.Web.RoleDefinitions.GetByName($PermissionLevel)

            $roleAssignment = new-object Microsoft.SharePoint.Client.RoleAssignment($SiteGroup)

            $list.BreakRoleInheritance($True, $False)
            Write-Host "Successfully added <$GroupName> to the <$ListName> list in <$site>. " -foregroundcolor Green
                Write-Host "No Students groups exist." -foregroundcolor Red

My error is in

$roleAssignment = new-object Microsoft.SharePoint.Client.RoleAssignment($SiteGroup)

, where I'm recieving the error

Cannot find an overload for "RoleAssignment" and the argument coun
t: "1".

Most tutorials use

$roleAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($SiteGroup)

which I CAN NOT USE.

How can I complete my code?

P.S. I know my code is a bit messy, but I've been spending too much time trying to find a solution, and my code has greatly reduced in quality over the past hours. Sorry for that.


You should use microsoft.SharePoint.Client.RoleDefinitionBindingCollection instead of Microsoft.SharePoint.Client.RoleAssignment.

Try below snippet (Not tested but will give you idea of what all steps are required):

# Get the list by Title and load.
$web = $ctx.Web 
$list = $web.Lists.GetByTitle("Quiz")
 # Load in list of groups on the current web.
$groups = $web.SiteGroups


$listTitle = $list.Title

foreach($group in $groups)
        if($group.Title -eq "Students")
                $roleAssignment = $null 
                # Get the group and load into context to be used.
                $StudentsGrp = $groups.GetById($group.Id)

                # Break inheritance on the list and remove existing permissons.
                $list.BreakRoleInheritance($false, $true)

                # Get the permissions role for 'Read'
                $reader = $web.RoleDefinitions.GetByName("Read")

                # Create a role assignment and apply the 'read' role.
                $roleAssignment = New-Object Microsoft.SharePoint.Client.RoleDefinitionBindingCollection($ctx)

                # Apply the  permission roles to the list.
                $ctx.Load($list.RoleAssignments.Add($StudentsGrp, $roleAssignment))

To add Everyone - Account name for Everyone is c:o(.s|true as per this blog.

  # Ensure the user exists on the site level, using EnsureUser.
    $everyone= $ctx.Site.RootWeb.EnsureUser("c:o(.s|true")
    $ctx.Load($list.RoleAssignments.Add($everyone, $roleAssignment))    
  • This worked on first try! Thank you so much! BTW, follow-up question: Is it possible to do the same for the pre-made group "Everyone"? I would like to assign "Everyone" to read-only on the list "Quiz", but I'm not able to find the group, even if it's on my SharePoint site. – Coder1234 Jun 29 '15 at 9:49
  • "Everyone" is not a SharePoint group but a AD group is uppose ie why you are not able to find it in SharePoint groups. See this link czerwsup.wordpress.com/2014/02/17/… – Unnie Jun 29 '15 at 9:54
  • Thanks! How can one easily translate between .NET syntax and CSOM? I see that the link you provided shows .NET syntax, but I am in need of the CSOM version of that. – Coder1234 Jun 29 '15 at 10:50
  • Added powershell csom syntax to answer – Unnie Jun 29 '15 at 12:08

Using csom PowerShell you can try below function to give a group your desired permissions it uses Microsoft.SharePoint.Client.RoleDefinitionBindingCollection and Microsoft.SharePoint.Client.RoleType to get role types.

function Set-PermissionsOnList()
            #get Client Object
            $context = New-Object Microsoft.SharePoint.Client.ClientContext($url)
            $context.Credentials = $credentials
            $web = $context.Web 

            # get root web
            $RootWeb = $context.Site.RootWeb

            # get list
            #$lists = $web.Lists
            #$list = $lists | where {$_.Title -eq $listName}

            #Retrieve List
            $List = $context.Web.Lists.GetByTitle($listName)

            $list.BreakRoleInheritance($true, $false)
            $roleType = [Microsoft.SharePoint.Client.RoleType]$Roletype

            # get group/principal
            $groups = $web.SiteGroups
            $group = $groups | where {$_.Title -eq $RootWeb.Title + " " + $GroupName}

            # get role definition
            $roleDefs = $web.RoleDefinitions
            $roleDef = $roleDefs | where {$_.RoleTypeKind -eq $Roletype}
            Write-Host "Error while getting context. Error -->> "  + $_.Exception.Message -ForegroundColor Red
            # Assign permissions
            $collRdb = new-object Microsoft.SharePoint.Client.RoleDefinitionBindingCollection($context)
            $collRoleAssign = $list.RoleAssignments
            $rollAssign = $collRoleAssign.Add($group, $collRdb)

            Write-Host "Permissions assigned successfully." -ForegroundColor Green
            Write-Host "Error while setting permissions. Error -->> "  + $_.Exception.Message -ForegroundColor Red

And you can call the function like:

$credentials = Get-Credential
$ListTitle = "Your List Name"
Set-PermissionsOnList "http://YourSite" $credentials $ListTitle "Students" "Read"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.