1

We have an online document library which contains around 1000 root folders, and we want to run a Power Shell script which runs on the 1000 root folders ONLY (without the sub-folders) >> then set unique permissions on the roots folders >> get the current permissions Groups + Users >> grant them Read-Only.

Can anyone advice on such a Script ?

I have the following:-

#Parameters
$SiteURL="https://******.sharepoint.com/"
$FolderSiteRelativeURL = "/Shared Documents/"
 
#Connect to the Site collection
Connect-PnPOnline -URL $SiteURL -UseWebLogin
 
#Get the Folder from site relative URL
$Folder = Get-PnPFolder -Url $FolderSiteRelativeURL
 
#Get all Subfolders of a folder - recursively
$SubFolders = Get-PnPFolderItem -FolderSiteRelativeUrl $FolderSiteRelativeURL -ItemType Folder -Recursive

ForEach($SubFolder in $SubFolders)
    {
If($SubFolder.ListItemAllFields.HasUniqueRoleAssignments)
{
    Write-host "Folder is already with broken permissions!" -f Yellow
}
Else
{
    #Break Folder permissions - keep all existing permissions & keep Item level permissions
    $SubFolder.ListItemAllFields.BreakRoleInheritance($True,$True)
    Invoke-PnPQuery
 
    Write-host "Folder's Permission Inheritance is broken!!" -f Green 
       /// Need the code which goes here......................  
}
    }

To get all the root folders, but how i can get the list of permissions assigned to the folder, and set its permission level to Read instead of Edit, Contribute or full access?

Thanks

EDIT

I tried this code:-

#Parameters
$SiteURL="https://***.sharepoint.com/"
$FolderSiteRelativeURL = "Shared Documents"
 
#Connect to the Site collection
Connect-PnPOnline -URL $SiteURL -UseWebLogin
 
#Get the Folder from site relative URL
$Folder = Get-PnPFolder -Url $FolderSiteRelativeURL
 
#Get all Subfolders of a folder - recursively
$SubFolders = Get-PnPFolderItem -FolderSiteRelativeUrl $FolderSiteRelativeURL -ItemType Folder -Recursive

ForEach($SubFolder in $SubFolders)
    {
If($SubFolder.ListItemAllFields.HasUniqueRoleAssignments)
{
    Write-host "Folder is already with broken permissions!" -f Yellow
}
Else
{
Write-host "Else is running" -f Yellow
    #Break Folder permissions - keep all existing permissions & keep Item level permissions
    $SubFolder.ListItemAllFields.BreakRoleInheritance($True,$True)
    $RoleAssignments = $SubFolder.ListItemAllFields.RoleAssignments
    ForEach($RoleAssignment in $RoleAssignments)
        {
            //extra code should goes here..
        }
 
    Write-host "Folder's Permission Inheritance is broken!!" -f Green   
}
    }

but i got this error:-

The collection has not been initialized. It has not been requested or the request has not been executed. It may need to be explicitly requested. At line:13 char:9

  • ForEach($RoleAssignment in $RoleAssignments)
  •     ~~~~~~~~~~~~~~~
    
    • CategoryInfo : OperationStopped: (:) [], CollectionNotInitializedException
    • FullyQualifiedErrorId : Microsoft.SharePoint.Client.CollectionNotInitializedException

1 Answer 1

1

SharePoint Permissions are handled via RoleAssignments. This is true for both Users and Groups.

I haven't used PS-CSOM alot, but you can Access the RoleAssignments via $SubFolder.RoleAssignments.

Maybe loop over them, Log them out and you'll most likely find what you are looking for.

I will get back to this Post later and maybe Update it to give a better, more detailed answer.

4
  • thanks for the info, can you check my edit please?
    – John John
    Aug 29, 2022 at 16:57
  • CSOM usually works with loading data explicitly and executequery() calls. Try to get a context and load data explicitly like this: $context = get-pnpcontext $context.load($web.roleassignments) $context.executequery() I sadly don't use PnP, instead I'm using the Powershell Sharepoint library in which you need a context by default. Going forward you'll need to iterate through the RoleAssignments, checking what Role Definition they have (basically permission level) and acting accordingly, either removing them or changing them to the read level.
    – Saik
    Aug 30, 2022 at 5:33
  • ok fine, but my question is about PnP Power shell and not CSOM ... they are different
    – John John
    Aug 30, 2022 at 6:17
  • PnP internally uses CSOM as well, it just abstracts it more. Which is why you can get a Context from pnp ($context = get-pnpcontext) and then use the "default" CSOM way of eagerly loading those roleassignments.
    – Saik
    Aug 30, 2022 at 9:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.