5

I've been reading a lot of answers regarding this PowerShell script but upon testing it, it seems that it's only granting access to a specific foldername.

I would like to grant access in a folder and IT'S subfolders. The only thing that this answer has provided me is grant the user access to the folder with a specific name.

SharePoint Online PowerShell Script to add permissions on folders and subfolder

Folder Structure example

2010-2011

  • Location1
  • Location2

2011-2012

  • Location1
  • Location2

I would like to grant the user access to 2011-2012 folder and subfolders, without affecting the 2010-2011 permission structure.

Is this possible?

4
  • When you grant permissions to the specific folder (2011-2012), each of it's subfolder (Location1, Location2) would inherit these permissions. So are the permissions for '2011-2012' and 'Location1' folders different or not?
    – AlexZh
    Jun 27, 2018 at 6:09
  • Oh sorry I forgot to indicate that Location 1 and Location 2 has unique permissions also.
    – Denisse
    Jun 27, 2018 at 6:26
  • 1
    SharePoint does not play well with broken permissions. You should try to limit the amount of permission breakings. The official number of security scopes is quite high (supported limit) but the performance issues start much faster. Jun 27, 2018 at 8:06
  • Thanks guys! As much as I want to clean up this library's permissions, they want it as is..
    – Denisse
    Jun 27, 2018 at 23:52

1 Answer 1

3

You can iterate through folders and set permissions with this script. It will go through all of your folders and set the permissions to contribute. Just set your site url, the list name and the group name/user name in the respective script.

How to grant permissions on group

Please check on test list before using in your productive environment.

Add-PSSnapin Microsoft.SharePoint.PowerShell -erroraction SilentlyContinue
  $site = new-object Microsoft.SharePoint.SPSite("https://siteurl")
  $web = $site.OpenWeb()

  function GrantGroupPermission($groupName)
  {
   [Microsoft.SharePoint.SPGroupCollection]$spgroups = $web.SiteGroups
   [Microsoft.SharePoint.SPGroup]$spgroup = $spgroups[$groupName]
   Write-Host $spgroup.Name -ForegroundColor Red
   $sproleass=new-object Microsoft.SharePoint.SPRoleAssignment([Microsoft.SharePoint.SPPrincipal]$spgroup)
   $folder.BreakRoleInheritance("true")
   $sproleass.RoleDefinitionBindings.Add($web.RoleDefinitions["Contribute"])
   $folder.RoleAssignments.Add($sproleass);
   Write-Host "Permission provided for group ", $groupName
  }  

  $doclib=[Microsoft.SharePoint.SPDocumentLibrary]$web.Lists["ListNameHere"]
  $foldercoll=$doclib.Folders;
  foreach($folder in $foldercoll)
  {
   Write-Host $folder.Name
    GrantGroupPermission("GroupNameHere")
  }
  $web.Close()
  $site.Dispose()

If this script helps please set this answer as an answer for your question. Thanks

How to grant permissions on user

Please test in test library first.

Add-PSSnapin Microsoft.SharePoint.PowerShell -erroraction SilentlyContinue
$site = new-object Microsoft.SharePoint.SPSite("https://siteurl")
$web = $site.OpenWeb()

function GrantUserPermission($domainUserName)
{
[Microsoft.SharePoint.SPUserCollection]$spusers= [Microsoft.SharePoint.SPUserCollection]$web.SiteUsers
[Microsoft.SharePoint.SPUser]$spuser=$spusers[$domainUserName]
$sproleass=new-object Microsoft.SharePoint.SPRoleAssignment([Microsoft.SharePoint.SPPrincipal]$spuser)
$folder.BreakRoleInheritance("true")
$sproleass.RoleDefinitionBindings.Add($web.RoleDefinitions["Contribute"])
$folder.RoleAssignments.Add($sproleass);
Write-Host "Permission for user ", $domainUserName
}

$doclib=[Microsoft.SharePoint.SPDocumentLibrary]$web.Lists["ListNameHere"]
$foldercoll=$doclib.Folders;
foreach($folder in $foldercoll)
{
Write-Host $folder.Name
GrantUserPermission("Domain\domainUserNameHere")
}
$web.Close()
$site.Dispose()

### proof of concept group permission ###

Created a document library named "doc" on a test site. Created two folders "a1" and "a2" with inheriting permissions from site in "doc". Created two folders in each of the two folders. In "a1" there are two folders "a11" and "a12". In folder "a2" two folders were created as well - "a21" and "a22".

Structure of folders in "doc":

a1
  -a11
  -a12
a2
  -a21
  -a22

All folders have permission inherritation activated from site.

Now script was run as shown above with site URL and "doc" library name set. The group to add contribute is "Testseite TI Owners".

Console output of the script:

a1
Testseite TI Owners
Permission provided for group  Testseite TI Owners
a2
Testseite TI Owners
Permission provided for group  Testseite TI Owners
a11
Testseite TI Owners
Permission provided for group  Testseite TI Owners
a12
Testseite TI Owners
Permission provided for group  Testseite TI Owners
a21
Testseite TI Owners
Permission provided for group  Testseite TI Owners
a22
Testseite TI Owners
Permission provided for group  Testseite TI Owners

Checked permissions of the folders. All folders have broken inheritance with full set of permissions with "contribute" added to the Owners group.

Now cleaned up the permissions on a sub folder and removed everything except the Owners contribute.

Re-run the script with the "Testseite TI Members" group to check what happens when inheritance was broken before running the script.

Outcome as expected

a1
Testseite TI Members
Permission provided for group  Testseite TI Members
a2
Testseite TI Members
Permission provided for group  Testseite TI Members
a11
Testseite TI Members
Permission provided for group  Testseite TI Members
a12
Testseite TI Members
Permission provided for group  Testseite TI Members
a21
Testseite TI Members
Permission provided for group  Testseite TI Members
a22
Testseite TI Members
Permission provided for group  Testseite TI Members

Checked the folder permissions of a sub directory. Now two groups have permission.

Testseite TI Owners Contribute
Testseite TI Members Contribute

The script works fine to set permissions to directory structures to top folders as well as for sub folders no matter if permission inheritance was broken or was activated before running the script.

Tested on SharePoint 2016 on premise with April 2018 patch level on June 28 2018

5
  • Hi Phil, Thanks for the script but this only grants permission on the top folder. the subfolders (which has unique permissions) is not affected.
    – Denisse
    Jun 27, 2018 at 23:51
  • Hi Denisse, I checked the script and proved functionality. Have edited my answer. Check my test and compare to your findings. Hope this helps.
    – PhilFancy
    Jun 28, 2018 at 5:31
  • Hi Phil, if I change it to username, would that matter? Thank you so much for the effort in helping me out.
    – Denisse
    Jun 29, 2018 at 2:19
  • Hey Denisse I added a script for setting user based permissions. See the post for further information. If this helps solving your needs please mark as answer. Thank you.
    – PhilFancy
    Jun 29, 2018 at 5:33
  • Hi Phil, Thank you for the answer! it helped a lot..
    – Denisse
    Jul 3, 2018 at 4:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.