We have a multitude of sites and sub-sites in SharePoint. As we run Azure AD Connect, we are able to assign Windows security group as Site Collection Administrators and further - assign AD groups to SharePoint groups, so we only need amends on AD side when anybody needs a change of permissions.

My plan is to:

  1. Reset any permissions granted so far on all sites and subsites
  2. Map AD groups to SharePoint groups for each site
  3. Break inheritance on document libraries and disable site visitors from having read access on it

Due to the number of sites I would really like to do it via PowerShell to avoid any human error.

Being fairly new to Sharepoint business, I can see very limited set of cmdlets for Sharepoint online available through Sharepoint Online Shell (released 9 June 2016), and can't wrap my head around the solution using only this set.

I'll gladly accept an answer listing cmdlets\methods needed for getting subsites, libraries, lists and amending permissions for them.

1 Answer 1


One of my favorite ways to automate repetitive tasks is to use PowerShell + CSOM.

The Client Object Model allows me to run my scripts on top of on-prem SharePoint or Office 365 using the exact same code, so I don't have to migrate it in order to make it run in one or the other.

enter image description here

Here is an example of how you use the client dll in a PowerShell script to authenticate and then perform regular queries through CSOM (more examples in the link below).

    $url = "https://blah.sharepoint.com/sites/dev",
    $username = "[email protected]",
    $password = "oopsalmostforgottoremovethis"


Add-Type -Path "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.dll"
Add-Type -Path "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.Runtime.dll"

$securePassword = ConvertTo-SecureString $password -AsPlainText -Force

$ctx = New-Object Microsoft.SharePoint.Client.ClientContext($url)
$credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($username, $securePassword) 
$ctx.Credentials = $credentials 

$list = $ctx.Web.Lists.GetByTitle("Documents")
Invoke-LoadMethod -Object $list -PropertyName "HasUniqueRoleAssignments"

#break permissions inheritance
    $list.BreakRoleInheritance(($copyRoleAssignments=$false), ($clearSubscopes=$true))

Make sure to stop by Chris O'brien's blog to check this out in detail.

You may also want to take a look at the other APIs as well, then chose the one that suits you best.

Complete basic operations using SharePoint 2013 client library code

Download latest CSOM

  • Thanks for this explanation and blog link. Regarding the script itself, as a minor improvement, I used [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client" ) [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client.Runtime" ) to load dlls as they aren't in the folder referenced if you just have Sharepoint Online module installed Jul 22, 2016 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.