5

I have a script that will look up a user based on a folder name and then add that user to the folder permissions with read rights.

Right now I have a few groups setup with explicit user assignment (i.e. manually added to the groups). When i run the below script it works perfectly for those users that are explicitly assigned to those groups. However, when a user does not belong to those groups or are in a nested AD group they are not being found.

How do i get pnp-powershell to "resolve" a user that exists in AD but no explicitly assigned to a SharePoint group? See $user variable line for the code i am trying to figure out.

For example. I have a folder named JCANNING that i use Get-PnPUser | Where Title -Like "*JCANNING*". If JCANNING is in the title of a user already explicitly added to the site, it resolves. But if JCANNING happens to be in a an AD group called "All AD Users" it is not found. How can I get it to query the AD users to get the user?

    $Url = 'https://SharePoint/Site/Path'
    $Library = 'Team Reports'
    $RootFolder = '/Team Reports/Engineers'

    Connect-PnPOnline -Url $Url

    # Get Folders in the Root folder
    $folders = Get-PnPFolderItem -FolderSiteRelativeUrl $RootFolder

    # Break Inheritance on each folder and add the user rights
    foreach ($folder in $folders){
        # Get the user based on folder name
        $user = Get-PnPUser | Where Title -Like "*$($folder.Name)*" # Code in Question

        # Break folder inheritance
        $folder.ListItemAllFields.BreakRoleInheritance($false,$false)
        $folder.Context.Load($folder.ListItemAllFields)
        $folder.Context.Load($user)
        $folder.Update()
        $folder.Context.ExecuteQuery()
        Write-Host "Inheritance broken for" $($folder.Name) -ForegroundColor Cyan

        # Add Team Editors group to the list and remove all other permissions
        Set-PnPListItemPermission -List $Library -Identity $($folder.ListItemAllFields.Id) -Group 'Team Editors' -AddRole 'Edit' -ClearExisting
        Write-Host "Adding Group 'Team Editors' to folder" $($folder.Name) -ForegroundColor DarkMagenta

        # Add the user based on folder name with Read rights
        Set-PnPListItemPermission -List $Library -Identity $($folder.ListItemAllFields.Id) -User $($user.Email) -AddRole 'Read'
        Write-Host "Adding user" $($user.LoginName) "to folder" $($folder.Name) -ForegroundColor DarkCyan
    }
3

Here is what I ended up needing to do if someone else needed something like this

Import-Module ActiveDirectory #will required to be downloaded/installed

$Url = 'https://SharePoint/Site/Path'
$Library = 'Team Reports'
$RootFolder = '/Team Reports/Engineers'

Connect-PnPOnline -Url $Url

# Get Folders in the Root folder
$folders = Get-PnPFolderItem -FolderSiteRelativeUrl $RootFolder

# Break Inheritance on each folder and add the user rights
foreach ($folder in $folders){
    # Get the user based on folder name
    $name = $($folder.Name)
    $email = Get-ADUser -Filter{SamAccountName -Like $name}

    # Break folder inheritance
    $folder.ListItemAllFields.BreakRoleInheritance($false,$false)
    $folder.Context.Load($folder.ListItemAllFields)
    #$folder.Context.Load($user)
    $folder.Update()
    $folder.Context.ExecuteQuery()
    Write-Host "Inheritance broken for" $($folder.Name) -ForegroundColor Cyan

    # Add Team Editors group to the list and remove all other permissions
    Set-PnPListItemPermission -List $Library -Identity $($folder.ListItemAllFields.Id) -Group 'Team Editors' -AddRole 'Edit' -ClearExisting
    Write-Host "Adding Group 'Team Editors' to folder" $($folder.Name) -ForegroundColor DarkMagenta

    # Add the user based on folder name with Read rights
    Set-PnPListItemPermission -List $Library -Identity $($folder.ListItemAllFields.Id) -User $email.UserPrincipalName -AddRole 'Read'
    Write-Host "Adding user" $($email.Name) "to folder" $($folder.Name) -ForegroundColor DarkCyan
}
2

There is no PnP native way to do this but you can do it by dropping down into the CSOM EnsureUser method. Try this:

$web = get-pnpweb
$user = $web.EnsureUser("user@company.com")
$ctx = Get-PnPContext
$ctx.Load($user)
Execute-PnPQuery

$user
  • Thanks Derek but I need to get the user by searching for part of their "Title". I wont know their email address, that is what i need to look up. Thoughts on that? – jAC Mar 16 '18 at 16:11
  • Your example JCANNING looks a lot like a user ID. Is this someone's actual name? I guess I'm confused. – Derek Gusoff Mar 16 '18 at 16:25
  • sorry its not truly a user ID its being stripped from the Get-PnPUser title. The full name is "John Canning (JCANNING)". I am just searching based on JCANNING as that is the name of the folder. In short it is the users id (e.g. domain\jcanning) but $web.EnsureUser only allows me to lookup based on email or so it seems. I tried domain\username but it did find the user. I tried UPN and it did. – jAC Mar 16 '18 at 16:32
  • It's not actually an email although it looks like one. It's a SharePoint Online login ID (which probably is identical to email address but not necessarily). The domain\username pattern will work with EnsureUser for (most) on-premises SharePoint environments, but SPO uses a different pattern. So, if the folder title in the parentheses is actually a user ID you should be able to pass "jcanning@yourcompany.com" into EnsureUser. If that doesn't work for you you're probably going to have to query active directory. – Derek Gusoff Mar 16 '18 at 17:00
  • I got this to work but i had to use the AD module simple enough. I will add an answer with the script i used. Thanks for your help Derek! – jAC Mar 16 '18 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.