Manipulating permissions on SharePoint Online with PowerShell

Question

We have a multitude of sites and sub-sites in SharePoint. As we run Azure AD Connect, we are able to assign Windows security group as Site Collection Administrators and further - assign AD groups to SharePoint groups, so we only need amends on AD side when anybody needs a change of permissions.

My plan is to:

1. Reset any permissions granted so far on all sites and subsites
2. Map AD groups to SharePoint groups for each site
3. Break inheritance on document libraries and disable site visitors from having read access on it

Due to the number of sites I would really like to do it via PowerShell to avoid any human error.

Being fairly new to Sharepoint business, I can see very limited set of cmdlets for Sharepoint online available through Sharepoint Online Shell (released 9 June 2016), and can't wrap my head around the solution using only this set.

I'll gladly accept an answer listing cmdlets\methods needed for getting subsites, libraries, lists and amending permissions for them.

Answer 1

One of my favorite ways to automate repetitive tasks is to use PowerShell + CSOM.

The Client Object Model allows me to run my scripts on top of on-prem SharePoint or Office 365 using the exact same code, so I don't have to migrate it in order to make it run in one or the other.

Here is an example of how you use the client dll in a PowerShell script to authenticate and then perform regular queries through CSOM (more examples in the link below).

param(
    $url = "https://blah.sharepoint.com/sites/dev",
    $username = "[email protected]",
    $password = "oopsalmostforgottoremovethis"
)

clear-host

Add-Type -Path "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.dll"
Add-Type -Path "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.Runtime.dll"

$securePassword = ConvertTo-SecureString $password -AsPlainText -Force

$ctx = New-Object Microsoft.SharePoint.Client.ClientContext($url)
#o365-auth
$credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($username, $securePassword) 
$ctx.Credentials = $credentials 

$list = $ctx.Web.Lists.GetByTitle("Documents")
$ctx.Load($list)
#http://sharepoint.stackexchange.com/questions/126221/spo-retrieve-hasuniqueroleassignements-property-using-powershell
Invoke-LoadMethod -Object $list -PropertyName "HasUniqueRoleAssignments"
$ctx.ExecuteQuery()

#break permissions inheritance
if(!$list.HasUniqueRoleAssignments)
{
    $list.BreakRoleInheritance(($copyRoleAssignments=$false), ($clearSubscopes=$true))
    $ctx.ExecuteQuery()
}

Make sure to stop by Chris O'brien's blog to check this out in detail.

You may also want to take a look at the other APIs as well, then chose the one that suits you best.

Complete basic operations using SharePoint 2013 client library code

Download latest CSOM