SharePoint PnP Powershell - How to provision sub webs with unique permissions and default groups?

Question

I've used the PnP Site provisioning method to create a sub web with unique permissions. However, when applying an XML site template with the default visitors, members, and owners security group defined in the template sections, the groups are not assigned. So what's the best method using PnP PowerShell to create sub webs with unique permissions and standard groups?

Here's my PowerShell:

#Connect to Site Collection
$me = Get-Credential
Connect-PNPOnline -url  https://mytenet.sharepoint.com/sites/MySiteCollection -credential $me

#Create sub web with unique permissions
New-PnPWeb -Title "ProjectB Web" -Url ProjectB -Description "Information about ProjectB"  -BreakInheritance -InheritNavigation -Template "STS#0"

#Apply template with groups.  Templates applies OK, but groups are not defined  
Apply-PnPProvisioningTemplate -Path C:\ProjectSiteTemplate.xml -Web projectB

Answer 1

This is a standard behaviour whenever we create a new Subweb using CSOM which is what ultimately PnP PowerShell is based upon.

So , you need to create and associate the groups yourselves using the New-PnPGroup and then Set-PnPGroup to associate the groups.

Something as below:

#Connect to Site Collection
$me = Get-Credential
Connect-PnPOnline -Url  https://mytenet.sharepoint.com/sites/MySiteCollection -Credentials $me

#Create sub web with unique permissions
New-PnPWeb -Title "ProjectB Web" -Url ProjectB -Description "Information about ProjectB"  -BreakInheritance -InheritNavigation -Template "STS#0"

Connect-PnPOnline -Url "https://mytenet.sharepoint.com/sites/MySiteCollection/ProjectB" -Credentials $me
$owner = (Get-PnPContext).Credentials.UserName

#Create default groups for the new web
#here, by default owner will be the person provisioning the groups
$ownerGroup = New-PnPGroup -Title "ProjectB Web Owners" -Owner $owner
Set-PnPGroup -Identity $ownerGroup -SetAssociatedGroup Owners

$memberGroup = New-PnPGroup -Title "ProjectB Web Members"  -Owner $owner
Set-PnPGroup -Identity $memberGroup -SetAssociatedGroup Members

$visitorGroup = New-PnPGroup -Title "ProjectB Web Visitors" -Owner $owner
Set-PnPGroup -Identity $visitorGroup -SetAssociatedGroup Visitors

#Apply template with groups.  Templates applies OK, but groups are not defined  
Apply-PnPProvisioningTemplate -Path C:\ProjectSiteTemplate.xml -Web projectB

Reference - Set PnPGroup

New PnPGroup

Answer 2

I don't have enough reputation to comment, but I wanted add to @gautam-sheth's answer. I had to explicitly add permissions to my groups, in order for them to show up properly in the new subsite, like so:

$ownerGroup = New-PnPGroup -Title "$req_query_sitename Owners" -Owner $env:SPO_U
Set-PnPGroup -Identity $ownerGroup -SetAssociatedGroup Owners
Set-PnPGroupPermissions -Identity $ownerGroup -AddRole 'Full Control'

Add-LogFileMessage "adding '$req_query_sitename Members' group to new $req_query_sitename site"

$memberGroup = New-PnPGroup -Title "$req_query_sitename Members" -Owner $env:SPO_U
Set-PnPGroup -Identity $memberGroup -SetAssociatedGroup Members
Set-PnPGroupPermissions -Identity $memberGroup -AddRole Contribute

Add-LogFileMessage "adding '$req_query_sitename Visitors' group to new $req_query_sitename site"

$visitorGroup = New-PnPGroup -Title "$req_query_sitename Visitors" -Owner $env:SPO_U
Set-PnPGroup -Identity $visitorGroup -SetAssociatedGroup Visitors
Set-PnPGroupPermissions -Identity $visitorGroup -AddRole Read

Answer 3

In addition to above, a best practice is not to use a single user as groups owner but instead use the Owners group as owner of all groups, so -Owner $ownerGroup