5

We're on Sharepoint Online. After migration, would like to validate that all permissions are applied accordingly.

Have following code :

Connect-PnPOnline -Url $siteUrl
$context = Get-PnPContext
$folder= Get-PnPFolder -Url $filePath -Includes ListItemAllFields.RoleAssignments

Not sure how to iterate above folder and get name of respected group/member name

       foreach($collection in $folder.ListItemAllFields.RoleAssignments)
       {
         $a = $collection.Member
         Write-Host $a
       }

And how can I retrieve same at file/document level

$file = Get-PnPFile -Url $filePath
  • moderators: sorry for posting an answer yet agian but I'm missing one credit to get to 50 to be able to post comments. Please convert this to a comment. Thanks. @Randeep Singh: Thanks for your reply. I got a little further trying to do this for a file. Loading the properties populated the 'HasUniqueRoleAssignments' which now contains 'True'. However, the property 'RoleAssignments' is empty. Therefore, the loop cannot iterate over it. So when I call '$file.RoleAssignments' I get an error message: format-default : The collection has not been initialized. It has not been requested or the request – colonel_claypoo Jan 23 '18 at 14:19
6

This is the method using PnP Online. Retrieve the additional properties using

Get-PnPProperty

Connect-PnPOnline -Url $siteUrl
$context = Get-PnPContext

For Files

$file = Get-PnPFile -Url $filePath -AsListItem
        Get-PnPProperty -ClientObject $file -Property HasUniqueRoleAssignments, RoleAssignments

        if($file.HasUniqueRoleAssignments -eq $True) 
        {
            foreach($roleAssignments in $file.RoleAssignments )  
            {
                Get-PnPProperty -ClientObject $roleAssignments -Property RoleDefinitionBindings, Member

                $permission.LoginName = $roleAssignments.Member.LoginName
                $permission.LoginTitle = $roleAssignments.Member.Title
                $permission.PrincipalType = $roleAssignments.Member.PrincipalType.ToString()
                $permission.Permission = ""
                #Get the Permissions assigned to user 
                foreach ($RoleDefinition  in $roleAssignments.RoleDefinitionBindings) 
                { 
                    $permission.Permission = $permission.Permission + "," + $RoleDefinition.Name 
                }
            }
        }

For folders

        $file = Get-PnPFolder -Url $filePath -Includes ListItemAllFields.RoleAssignments, ListItemAllFields.HasUniqueRoleAssignments
        $context.Load($file);
        $context.ExecuteQuery();

        if($file.ListItemAllFields.HasUniqueRoleAssignments -eq $True) 
        {
            foreach($roleAssignments in $file.ListItemAllFields.RoleAssignments)
            {
                Get-PnPProperty -ClientObject $roleAssignments -Property RoleDefinitionBindings, Member

                $permission.LoginName = $roleAssignments.Member.LoginName
                $permission.LoginTitle = $roleAssignments.Member.Title
                $permission.PrincipalType = $roleAssignments.Member.PrincipalType.ToString()
                $permission.Permission = ""
                 #Get the Permissions assigned to user/group
                foreach ($RoleDefinition in $roleAssignments.RoleDefinitionBindings){
                     $permission.Permission = $permission.Permission + "," + $RoleDefinition.Name
                }
            }
        }
  • I was trying out your code for files. However, the property 'RoleAssignments' is not populated at Get-PnPProperty (line 8). Upon trying to load it $context I would get: "Cannot find an overload for "Load" and the argument count: "1". Therefore, can I assume that this property was empty to begin with right? Furthermore, becaus of this, I think, assigning the $roleAssignments properties Member.LoginName, Member.Title and Member.PrincipalType to $permission is not possible and throws an error that goes like:"The property "LoginName" was not found for this object". Has this script – colonel_claypoo Jan 22 '18 at 10:43
  • @colonel_claypoo the above code is tested and works fine. If you use Get-PnPProperty, do not have to execute the $context. My $context execution above is to load the folder. If that is failing, perhaps your path doesn't exist. – Randeep Singh Jan 23 '18 at 9:49
  • 1
    @colonel_claypoo, you're commenting everywhere. I will try to continue in this thread. After checking HasUniqueRoleAssignments, try to load the roles using $context instead. $context.Load($file.RoleAssignments); $context.ExecuteQuery(); – Randeep Singh Jan 25 '18 at 3:31
2

This script should help you:

https://gallery.technet.microsoft.com/office/SharePoint-Permissions-f42ea9db

Check this bit:

     foreach($List in $Web.lists) 
        { 
            if($List.HasUniqueRoleAssignments -eq $True -and ($List.Hidden -eq $false)) 
            { 
                #Get all the users granted permissions to the list 
                foreach($ListRoleAssignment in $List.RoleAssignments )  
                {  
                    #Is it a User Account? 
                    if($ListRoleAssignment.Member.userlogin)     
                    { 
                        #Get the Permissions assigned to user 
                        $ListUserPermissions=@() 
                        foreach ($RoleDefinition  in $ListRoleAssignment.RoleDefinitionBindings) 
                        { 
                            $ListUserPermissions += $RoleDefinition.Name +";" 
                        } 

                        #Send the Data to Log file 
                        "$($List.ParentWeb.Url)/$($List.RootFolder.Url)`tList`t$($List.Title)`tDirect Permission`t$($ListUserPermissions) `t$($ListRoleAssignment.Member)" | Out-File $FileUrl -Append 
                    } 
                    #Its a SharePoint Group, So search inside the group and check if the user is member of that group 
                    else   
                    { 
                        foreach($user in $ListRoleAssignment.member.users) 
                        { 
                            #Get the Group's Permissions on site 
                            $ListGroupPermissions=@() 
                            foreach ($RoleDefinition  in $ListRoleAssignment.RoleDefinitionBindings) 
                            { 
                                $ListGroupPermissions += $RoleDefinition.Name +";" 
                            } 

                            #Send the Data to Log file 
                            "$($List.ParentWeb.Url)/$($List.RootFolder.Url)`tList`t$($List.Title)`tMember of $($ListRoleAssignment.Member.Name) Group`t$($ListGroupPermissions)`t$($user.LoginName)" | Out-File $FileUrl -Append 
                        } 
                    }     
                } 
            } 

            #Get Folder level permissions 
            foreach($Folder in $List.folders) 
            { 
                if($Folder.HasUniqueRoleAssignments -eq $True) 
                { 
                    #Get all the users granted permissions to the folder 
                    foreach($FolderRoleAssignment in $Folder.RoleAssignments )  
                    {  
                        #Is it a User Account? 
                        if($FolderRoleAssignment.Member.userlogin)     
                        { 
                            #Get the Permissions assigned to user 
                            $FolderUserPermissions=@() 
                            foreach ($RoleDefinition  in $FolderRoleAssignment.RoleDefinitionBindings) 
                            { 
                                $FolderUserPermissions += $RoleDefinition.Name +";" 
                            } 

                            #Send the Data to Log file 
                            "$($Folder.Web.Url)/$($Folder.Url)`tFolder`t$($Folder.Title)`tDirect Permission`t$($FolderUserPermissions) `t$($FolderRoleAssignment.Member)" | Out-File $FileUrl -Append 
                        } 
                        #Its a SharePoint Group, So search inside the group and check if the user is member of that group 
                        else   
                        { 
                            foreach($user in $FolderRoleAssignment.member.users) 
                            { 
                                #Get the Group's Permissions on site 
                                $FolderGroupPermissions=@() 
                                foreach ($RoleDefinition  in $FolderRoleAssignment.RoleDefinitionBindings) 
                                { 
                                    $FolderGroupPermissions += $RoleDefinition.Name +";" 
                                } 

                                #Send the Data to Log file 
                                "$($Folder.Web.Url)/$($Folder.Url)`tFolder`t$($Folder.Title)`tMember of $($FolderRoleAssignment.Member.Name) Group`t$($FolderGroupPermissions)`t$($user.LoginName)" | Out-File $FileUrl -Append 

                            } 
                        }     
                    } 
                } 
            } 

            #Get Item level permissions 
            foreach($Item in $List.items) 
            { 
                if($Item.HasUniqueRoleAssignments -eq $True) 
                { 
                    #Get all the users granted permissions to the item 
                    foreach($ItemRoleAssignment in $Item.RoleAssignments )  
                    {  
                        #Is it a User Account? 
                        if($ItemRoleAssignment.Member.userlogin)     
                        { 
                            #Get the Permissions assigned to user 
                            $ItemUserPermissions=@() 
                            foreach ($RoleDefinition  in $ItemRoleAssignment.RoleDefinitionBindings) 
                            { 
                                $ItemUserPermissions += $RoleDefinition.Name +";" 
                            } 

                            #Prepare item's absolute Url and Name 
                            $ItemDispForm = $Item.ParentList.Forms | where { $_.Type -eq "PAGE_DISPLAYFORM" } | Select-Object -first 1 
                            if ($ItemDispForm.Url) 
                            { 
                                $ItemUrl = "$($Item.Web.Url)/$($ItemDispForm.Url)?ID=$($Item.ID)"  
                            } 
                            else 
                            { 
                                $ItemUrl = "$($Item.Url)" 
                            } 

                            if ($Item.Name) 
                            { 
                                $ItemTitle = $Item.Name 
                            } 
                            else 
                            { 
                                $ItemTitle = $Item.Title 
                            } 

                            #Send the Data to Log file 
                            "$($ItemUrl)`tItem`t$($ItemTitle)`tDirect Permission`t$($ItemUserPermissions) `t$($ItemRoleAssignment.Member)" | Out-File $FileUrl -Append 
                        } 
                        #Its a SharePoint Group, So search inside the group and check if the user is member of that group 
                        else   
                        { 
                            foreach($user in $ItemRoleAssignment.member.users) 
                            { 
                                #Get the Group's Permissions on site 
                                $ItemGroupPermissions=@() 
                                foreach ($RoleDefinition  in $ItemRoleAssignment.RoleDefinitionBindings) 
                                { 
                                    $ItemGroupPermissions += $RoleDefinition.Name +";" 
                                } 

                                #Prepare item's absolute Url and Name 
                                $ItemDispForm = $Item.ParentList.Forms | where { $_.Type -eq "PAGE_DISPLAYFORM" } | Select-Object -first 1 
                                if ($ItemDispForm.Url) 
                                { 
                                    $ItemUrl = "$($Item.Web.Url)/$($ItemDispForm.Url)?ID=$($Item.ID)"  
                                } 
                                else 
                                { 
                                    $ItemUrl = "$($Item.Url)" 
                                } 

                                if ($Item.Name) 
                                { 
                                    $ItemTitle = $Item.Name 
                                } 
                                else 
                                { 
                                    $ItemTitle = $Item.Title 
                                } 

                                #Send the Data to Log file 
                                "$($ItemUrl)`tItem`t$($ItemTitle)`tMember of $($ItemRoleAssignment.Member.Name) Group`t$($ItemGroupPermissions)`t$($user.LoginName)" | Out-File $FileUrl -Append 

                            } 
                        }     
                    } 
                } 
            } 
  • Most objects are null here E.g. HasUniqueRoleAssignments RoleAssignments are null too - but has too be loaded in the context. – Randeep Singh Jul 25 '17 at 10:01
0

This works for me. I hope that helps.

$siteUrl = "https://tenant-sharepoint.com"
Connect-PnPOnline -Url $siteUrl -UseWebLogin

$documents = Get-PnPListItem -List "Documents"
$context = Get-PnPContext

$foldersUniquePermissions = @()
$filesUniquePermissions = @()

foreach($doc in $documents){

    $context.Load($doc)

    switch($doc.FileSystemObjectType){

        'Folder'{
        ## The substring is removing part of the path as this was run on a OneDrive Site
            $folder = Get-PnPFolder -Url ($doc.FieldValues.FileRef).Substring(37) -Includes ListItemAllFields.RoleAssignments, ListItemAllFields.HasUniqueRoleAssignments

            if($folder.ListItemAllFields.HasUniqueRoleAssignments){

                $foldersUnique += $doc
            }
        }

        'File'{

            $file = Get-PnPFile -Url $doc.FieldValues.FileRef -AsListItem
            Get-PnPProperty -ClientObject $file -Property HasUniqueRoleAssignments, RoleAssignments

            if($file.HasUniqueRoleAssignments -eq $True){

                $filesUnique += $doc
            }        
        }
    }
}

My first contribution ever. I hope that helps.

  • Welcome to the SharePoint S.E.! When you're posting scripts, please explain how the script works, and potentially the site you found it if it's not of your own creation. – KGlasier Sep 4 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.