As part of an SPO site creation script, I want to remove ' Visitors' from the permissions of a document library that is created in the script.

I've got as far as breaking the inheritance, but how can I remove a specific group from the permissions?

Thanks in advance.


2 Answers 2


In CSOM PowerShell, it would look something as mentioned in below code. Modify it as per your list and group names :

$SPOCredentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($userName,$password)

$Ctx = New-Object Microsoft.SharePoint.Client.ClientContext($siteUrl)
$Ctx.Credentials = $SPOCredentials

$web = $Ctx.Web

#load the groups
$groups = $web.SiteGroups

# get the SharePoint group
$Group = $groups.GetByName("<Your Visitor Group Name>");

$listName = $Ctx.web.Lists.GetByTitle("Custom List")

# break inheritance 
$listName.BreakRoleInheritance($true, $false)

# load the list role assignments

# remove the visitor group from the list
  • Thanks, will need a bit more help with this one please. Trying the below, but guess I'm missing something as I'm seeing an error: "The object is used in the context different from the one associated with the object." I presume I need to start with this? $SPOCredentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($userName,$password) $Ctx = New-Object Microsoft.SharePoint.Client.ClientContext($url) $Ctx.Credentials = $SPOCredentials
    – Tom Urwin
    Jul 4, 2018 at 13:32
  • can you check with edited code ? Jul 4, 2018 at 13:35
  • Thanks, but I still get the same error with Char 1 of this line, regardless of the group name: $Ctx.Load($Group);
    – Tom Urwin
    Jul 4, 2018 at 13:40
  • can you check with edited code ? Hope this make things a bit clear Jul 4, 2018 at 15:22
  • Thank you again... But now I have an error around the list name despite it matching the Document Library name exactly: 'You cannot call a method on a null-valued expression. At C:\temp\Scripts\Permissions4.ps1:29 char:1 + $listName = $lists.getByTitle("Internal Files")'
    – Tom Urwin
    Jul 4, 2018 at 15:32

This code can be used for this.It first breaks inheritance and then remove the specific group

$web=Get-SPWeb http://site url
$list = $web.Lists["list/library name"]
[Microsoft.SharePoint.SPRoleAssignmentCollection] $spRoleAssignments=$list.RoleAssignments
for([int] $a=$spRoleAssignments.Count-1; $a -ge 0;$a--)
   if($spRoleAssignments[$a].Member.Name -eq "groupName")
  • Thanks, but Get-SPWeb is for on-prem SharePoint isn't it? I need to do it in SharePoint Online. Cheers
    – Tom Urwin
    Jul 4, 2018 at 11:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.