How i can verify that our migrated "Contribute" permission level is exactly the same as the source Contribute permission

Question

I did a migration from SharePoint on-premises 2013 to SharePoint online, using a third party tool, as follow:-

1. The source on-premises site collection is a team site that have publishing features enabled and have 2 levels of sub sites. Also the build-in "Contribute" permission, have the "Manage Alerts - Manage alerts for all users of the Web site." permission unchecked as follow:-

2. To start the migration, I created a new online classic team site collection inside our office 365 and I migrated the on-premises site collection to it. And everything went fine. But today I were verifying the migrated online site, and I were comparing the permissions granted to the built-in permission levels, and I have noted that the migrated "Contribute" permission has the "Manage Alerts - Manage alerts for all users of the Web site." permission checked as follow:-

so now i know that i can uncheck the "Manage Alerts - Manage alerts for all users of the Web site.", and have the permission check-boxes mimic the on-premises ones. but my question is how i can be sure that the migrated "Contribute" permission level is 100% identical to any "Contribute" permission level inside a brand new online site collection. for example can i do this:-

1. create a new online classic team site collection >> which will have a built-in "Contribute" permission level >> run a PnP script to get all the permission it has.
2. then run the same PnP script on the migrated site, and compare the 2 results.

now i know that i can access the Contribute permission level from the UI (as i did when i noticed the problem), but as i know that the UI permission check-boxes are not the lowest level permission, where a checkbox can have 2 or more lower level permissions underneath it. So my question is how i can get these lower level permissions for the "Contribute" permission level, to compare them inside the migrated site and inside a band new online site? Thanks.

Answer 1

I can show how to get this using JavaScript and REST:

$.ajax({
    url: _spPageContextInfo.webAbsoluteUrl + "/_api/web/RoleDefinitions/getByName('Contribute')",
    async: false,
    headers: {
        'accept': 'application/json;odata=nometadata'
    },
    complete: function (request) {
        var basePermissions = new SP.BasePermissions();
        basePermissions.initPropertiesFromJson(request.responseJSON.BasePermissions);

        var friendlyPermissions = [];
        for (var name in SP.PermissionKind.prototype) {
            if (name != "emptyMask") {
                var level = SP.PermissionKind.parse(name);
                if (basePermissions.has(level)) {
                    friendlyPermissions.push(name);
                }
            }
        }

        console.log("friendlyPermissions = " + JSON.stringify(friendlyPermissions, null, 4));
    },
    error: function (request) {
        console.log(JSON.stringify(request, null, 4));
    }
});

You can run this code in the browser developer tools console, and it will print the granular permissions to the console output. Just go to any classic page in your site, launch developer tools, and if jQuery isn't already loaded on the page run this once in the console:

var script = document.createElement('script');
script.type = 'text/javascript';
script.src = 'https://cdn.jsdelivr.net/npm/jquery@1.12.4/dist/jquery.js';
document.head.appendChild(script);

Then run the code above, and the console output should look like:

friendlyPermissions = [
    "viewListItems",
    "addListItems",
    "editListItems",
    "deleteListItems",
    "openItems",
    "viewVersions",
    "deleteVersions",
    "managePersonalViews",
    "viewFormPages",
    "open",
    "viewPages",
    "createSSCSite",
    "browseDirectories",
    "browseUserInfo",
    "addDelPrivateWebParts",
    "updatePersonalWebParts",
    "useClientIntegration",
    "useRemoteAPIs",
    "createAlerts",
    "editMyUserInfo"
    ]

And the results above are the OOB granular permissions for Contribute, at least on my SharePoint online tenant. I've only tested this code online, but it should work as far back as SharePoint 2013.

EDIT

If your not comfortable with developer tools, I've create a utility page that will do it (PermissionLevel2GranularPermissions.zip). The zip includes a single ASPX page that is actually a SharePoint wiki page, so you can drop it into any SharePoint document library and open it to use it. Choose a permission level from the drop down and click the Go Button, and it will put the granular permissions for the selected level in the text area.

I've commented it enough so hopefully you can see what it's doing. It's basically the same code as above, except first it calls "/_api/web/RoleDefinitions" to get the permission levels and populate the drop down. I have explicitly set the HTTP method to GET on both of the REST calls (that's actually the default in jQuery). In general, any write operations in REST need to use a request method other than GET (i.e. POST, PUT, MERGE, or DELETE), so setting the method to GET is enough to ensure you that it's not writing anything, just reading.