SharePoint Online Management Shell - PowerShell - Set-SPOSiteGroup - update SharePoint Group permissions for subsites

Question

I migrated from SharePoint 2010 to SharePoint Online with a 3rd party tool - background knowledge. The Security Group was in a local domain. I found an equivalent SharePoint Group group that I would like to use. I have a few 100+ sites and PowerShell will help. Sadly they are SUBSITES within ONE Site Collection. Again, we are migrating so it is a step to promote them to their own Site Collections.

I tested with

Set-SPOSiteGroup -Site "https://TenantDomain.SharePoint.com/sites/SiteCollectionName" -Identity "SharePoint Group Name" -PermissionLevelToAdd "Read"

this works FINE with the site collection, now when I put in /ABC I get

Set-SPOSiteGroup : The managed path sites/SiteCollectionName is not a managed path in this tenant.

In the management shell, I clicked the up arrow in my keyboard and appended the line that JUST worked and was working for the site collection. I want to set it on some subsites that have broken inheritance / unique permissions for each subsite. I just added that /ABC (no / at the end). Is there a different PowerShell command to run, etc.? Thank you.

Answer 1

Yes, the Set-SPOSiteGroup is expecting a site collection address. You may want to try Set-PnPGroupPermissions instead.

You can either connect the subsite directly using Connect-PnPOnline or you can use the Web parameter on Set-PnPGroupPermissions to specify the subsite. More information can be found here:

• Set-PnPGroupPermissions

Answer 2

Yes, the Set-SPOSiteGroup updates the SharePoint Online owner and permission levels on a group inside a site collection.

You could execute the following Powershell script:

#connect to subsite
$SiteURL= "https://test.spo.com/sites/projects/it"
Connect-PnPOnline -Url $SiteURL -UseWebLogin

#set permissions of a specific SharePoint group
Set-PnPGroupPermissions -Identity 'Echo Members' -RemoveRole 'Edit' -AddRole 'Read'

——————————————————Updated Answer—————————————————

You can execute the following script to replace the original script.

#connect to subsite
$SiteURL= "https://test.spo.com/sites/projects/it"
$username = "[email protected]"
$credential = Get-Credential -UserName $username -Message "Type the password:"
Connect-PnPOnline -Url $SiteUrl -Credentials $credential

#set permissions of a specific SharePoint group
Set-PnPGroupPermissions -Identity 'Echo Members' -RemoveRole 'Edit' -AddRole 'Read'

—————————————————— Updated Answer ————————————————

Basically it’s just not going to authenticate you because of MFA. To resolve this issue, use the -UseWebLogin parameter.

Your screen should look like this:

$SiteURL= "https://test.spo.com/sites/projects/it"
Connect-PnPOnline -Url $SiteUrl -UseWebLogin