Adding Read-Only-permissions to a list for a Sharepoint Group using Powershell CSOM

Question

I am trying to add read-only-permissions to a specific group called "Students" for a list I have created called "Quiz". I have to use PowerShell CSOM, and in every other tutorial I've been through, .NET server types have been used.

Code:

$ListName = "Quiz"
$PermissionLevel = "Read Only"
$web = $ctx.Web        

$lists = $web.Lists
$ctx.Load($lists)
$ctx.ExecuteQuery()
foreach($list in $lists)
{
    if($list.Title -eq $ListName)
    {
        $listId = $list.Id
    }
}
$list = $lists.GetById($listId)
$ctx.Load($list);
$ctx.ExecuteQuery();

Write-Host "List:" $List.Title -foregroundcolor Green
if ($list -ne $null)
{
    $groups = $web.SiteGroups
    $ctx.Load($groups)
    $ctx.ExecuteQuery()
    foreach ($SiteGroup in $groups) {                    
        if ($SiteGroup.Title -match "Students")
        {
            write-host "Group:" $SiteGroup.Title -foregroundcolor Green
            $GroupName = $SiteGroup.Title

            $builtInRole = $ctx.Web.RoleDefinitions.GetByName($PermissionLevel)

            $roleAssignment = new-object Microsoft.SharePoint.Client.RoleAssignment($SiteGroup)
            $roleAssignment.Add($builtInRole)

            $list.BreakRoleInheritance($True, $False)
            $list.RoleAssignments.Add($roleAssignment)
            $list.Update();
            Write-Host "Successfully added <$GroupName> to the <$ListName> list in <$site>. " -foregroundcolor Green
        }                
        else
        {
                Write-Host "No Students groups exist." -foregroundcolor Red
        }
    }
}

My error is in

$roleAssignment = new-object Microsoft.SharePoint.Client.RoleAssignment($SiteGroup)

, where I'm recieving the error

Cannot find an overload for "RoleAssignment" and the argument coun
t: "1".

Most tutorials use

$roleAssignment = new-object Microsoft.SharePoint.SPRoleAssignment($SiteGroup)

which I CAN NOT USE.

How can I complete my code?

P.S. I know my code is a bit messy, but I've been spending too much time trying to find a solution, and my code has greatly reduced in quality over the past hours. Sorry for that.

Answer 1

You should use microsoft.SharePoint.Client.RoleDefinitionBindingCollection instead of Microsoft.SharePoint.Client.RoleAssignment.

Try below snippet (Not tested but will give you idea of what all steps are required):

# Get the list by Title and load.
$web = $ctx.Web 
$list = $web.Lists.GetByTitle("Quiz")
$ctx.Load($list)
 # Load in list of groups on the current web.
$groups = $web.SiteGroups
$ctx.Load($groups)

$ctx.ExecuteQuery()

$listTitle = $list.Title

foreach($group in $groups)
{
        if($group.Title -eq "Students")
        {
                $roleAssignment = $null 
                # Get the group and load into context to be used.
                $StudentsGrp = $groups.GetById($group.Id)
                $ctx.Load($StudentsGrp)
                $ctx.ExecuteQuery()

                # Break inheritance on the list and remove existing permissons.
                $list.BreakRoleInheritance($false, $true)

                # Get the permissions role for 'Read'
                $reader = $web.RoleDefinitions.GetByName("Read")

                # Create a role assignment and apply the 'read' role.
                $roleAssignment = New-Object Microsoft.SharePoint.Client.RoleDefinitionBindingCollection($ctx)
                $roleAssignment.Add($reader)

                # Apply the  permission roles to the list.
                $ctx.Load($list.RoleAssignments.Add($StudentsGrp, $roleAssignment))
                $list.Update()
                $ctx.ExecuteQuery()
        }
}

To add Everyone - Account name for Everyone is c:o(.s|true as per this blog.

  # Ensure the user exists on the site level, using EnsureUser.
    $everyone= $ctx.Site.RootWeb.EnsureUser("c:o(.s|true")
    $ctx.Load($everyone)
    $ctx.Load($list.RoleAssignments.Add($everyone, $roleAssignment))    

Answer 2

Using csom PowerShell you can try below function to give a group your desired permissions it uses Microsoft.SharePoint.Client.RoleDefinitionBindingCollection and Microsoft.SharePoint.Client.RoleType to get role types.

function Set-PermissionsOnList()
{
    param(
        [Parameter(Mandatory=$true)][string]$url,
        [Parameter(Mandatory=$true)][System.Net.NetworkCredential]$credentials,
        [Parameter(Mandatory=$true)][string]$listName,
        [Parameter(Mandatory=$true)][string]$GroupName,
        [Parameter(Mandatory=$true)][string]$Roletype
    )
    begin{
        try
        {
            #get Client Object
            $context = New-Object Microsoft.SharePoint.Client.ClientContext($url)
            $context.Credentials = $credentials
            $web = $context.Web 
            $context.Load($web) 
            $context.ExecuteQuery()

            # get root web
            $RootWeb = $context.Site.RootWeb
            $context.Load($RootWeb) 
            $context.ExecuteQuery()

            # get list
            #$lists = $web.Lists
            #$context.Load($lists)
            #$context.ExecuteQuery()
            #$list = $lists | where {$_.Title -eq $listName}

            #Retrieve List
            $List = $context.Web.Lists.GetByTitle($listName)
            $context.Load($List)
            $context.ExecuteQuery()

            $list.BreakRoleInheritance($true, $false)
            $roleType = [Microsoft.SharePoint.Client.RoleType]$Roletype

            # get group/principal
            $groups = $web.SiteGroups
            $context.Load($groups)
            $context.ExecuteQuery()
            $group = $groups | where {$_.Title -eq $RootWeb.Title + " " + $GroupName}

            # get role definition
            $roleDefs = $web.RoleDefinitions
            $context.Load($roleDefs)
            $context.ExecuteQuery()
            $roleDef = $roleDefs | where {$_.RoleTypeKind -eq $Roletype}
        }
        catch
        {
            Write-Host "Error while getting context. Error -->> "  + $_.Exception.Message -ForegroundColor Red
        }
    }
    process{
        try
        {
            # Assign permissions
            $collRdb = new-object Microsoft.SharePoint.Client.RoleDefinitionBindingCollection($context)
            $collRdb.Add($roleDef)
            $collRoleAssign = $list.RoleAssignments
            $rollAssign = $collRoleAssign.Add($group, $collRdb)
            $context.ExecuteQuery()

            Write-Host "Permissions assigned successfully." -ForegroundColor Green
        }
        catch
        {
            Write-Host "Error while setting permissions. Error -->> "  + $_.Exception.Message -ForegroundColor Red
        }
    }
    end{
    $context.Dispose()
    }
}

And you can call the function like:

$credentials = Get-Credential
$ListTitle = "Your List Name"
Set-PermissionsOnList "http://YourSite" $credentials $ListTitle "Students" "Read"