I am developing some C# CSOM code that sets item level (folder) permissions in a SharePoint 2016 on premise document library. I am successful in assigning groups to folders, and some folders have subfolders that break inheritance and have a different group than their parent folder. After setting permissions on all folders, I run the following code to identify the groups assigned to each folder:

ListItems = docLibrary.GetItems(CamlQuery.CreateAllItemsQuery());
                clientContext.Load(ListItems, a => a.IncludeWithDefaultProperties(b => b.HasUniqueRoleAssignments, b => b.Folder, b => b.Folder.Name
                    , b => b.DisplayName, b => b["FileRef"], b => b["FileLeafRef"]),
                    permsn => permsn.Include(a => a.RoleAssignments.Include(roleAsg => roleAsg.Member.LoginName,
                            roleAsg => roleAsg.RoleDefinitionBindings.Include(roleDef => roleDef.Name,
                            roleDef => roleDef.Description))));

Then examine the role assignments, I expect to see one role assignment for the parent folder because I have assigned only one group to that folder. But I’m seeing (in one case) 45 role assignments which (I think) represents that total number of role assignments for all sub folders of the parent folder. Like this:

enter image description here And I don't know how to interrogate the role assignments to figure out which folder they are associated with. Can you help me to identify only the group assign to a particular folder? Thanks!

2 Answers 2


You have loaded RoleAssignments for corresponding item, so you could confirm it by checking item's permission(Share->Manage Access->Advanced).

enter image description here

enter image description here

enter image description here

  • Thanks Lee. I'm sure your suggestion makes sense, but I'm not seeing the connection to my issue; probably just me. I think I found a solution though, which I am about to post
    – Frank
    Commented Apr 7, 2020 at 2:18

You can try the below code:

ClientContext ctx = new ClientContext("http://server:port/sites/test");
Web web = ctx.Web;
List test = web.Lists.GetByTitle("Test Docs");
ListItemCollection itemColl = test.GetItems(CamlQuery.CreateAllFoldersQuery());
ctx.Load(itemColl, x => x.Include(
                       y => y.RoleAssignments.Include(z => z.Member),
                       y => y.DisplayName));

foreach (ListItem item in itemColl) 
    Console.Write(item.DisplayName + " folder permissions are: ");
    foreach (RoleAssignment role in item.RoleAssignments)
        Console.Write(role.Member.Title + "\t");

Similar question is discussed here :

How to get SharePoint Group Names having permission on Folder in SharePoint 2010

  • Thanks for your response Habibur. The code you provided doesn't appear to produce the result I'm looking for though. The item.RoleAssignments collection contains the same 45 objects. And, like I said in my original post, I think those 45 role assignments represent the role assignments associated with ALL sub folders, but I only want to see the role assignments for the current item/folder. Am I misunderstanding what those 45 role assignments represent? Can you tell me how to determine which of those 45 role assignments are associated with the top level folder in the folder hierarchy? Thanks!
    – Frank
    Commented Apr 3, 2020 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.