I have this code from this reply @ Stop Permission Inheritance >> set unique permission .. is this possible using PnP Core SDK .. to add a user to a folder permission:-

using (var scope = host.Services.CreateScope()) 
    // Ask an IPnPContextFactory from the host
    var pnpContextFactory = scope.ServiceProvider.GetRequiredService<IPnPContextFactory>();

    // Create a PnPContext
    using (var context = await pnpContextFactory.CreateAsync(new Uri(siteUrl)))
        // Get Root Folder
        var rootFolder = (await context.Web.Lists.GetByTitleAsync("Test Library", p => p.RootFolder)).RootFolder;

        // Ensure SubFolder
        var subFolder = await rootFolder.EnsureFolderAsync("TestFolder");

        // Break Inheritance on SubFolder [BreakRoleInheritance(bool copyRoleAssignments, bool clearSubscopes)]
        subFolder.ListItemAllFields.BreakRoleInheritance(false, true);

        // Get current user
        var currentUser = await context.Web.GetCurrentUserAsync();

        // Find role definition
        var roleDefinitions = (await context.Web.GetAsync(p => p.RoleDefinitions)).RoleDefinitions;
        var editRole = roleDefinitions.AsRequested().FirstOrDefault(p => p.Name == "Edit");

        // Add role to selected user
        await subFolder.ListItemAllFields.AddRoleDefinitionAsync(currentUser.Id, editRole);

but my question is can we add users, sharepoint groups, Office 365 groups & Security groups using ListItemAllFields.AddRoleDefinitionAsync()? or this is limit to certain types only ? Thanks

1 Answer 1


AddRoleDefinitionAsync keep as first argument an int representing a Principal.Id.

Principal can by one of these types (according to PrincipalType enum)

// Summary:
//     Specifies the type of a principal. This enumeration has a FlagsAttribute attribute
//     that allows a bitwise combination of its member values.
public enum PrincipalType
    // Summary:
    //     Enumeration whose value specifies no principal type. Value = 0.
    None = 0x0,
    // Summary:
    //     Enumeration whose value specifies a user as the principal type. Value = 1.
    User = 0x1,
    // Summary:
    //     Enumeration whose value specifies a distribution list as the principal type.
    //     Value = 2.
    DistributionList = 0x2,
    // Summary:
    //     Enumeration whose value specifies a security group as the principal type. Value
    //     = 4.
    SecurityGroup = 0x4,
    // Summary:
    //     Enumeration whose value specifies a group (2) as the principal type. Value =
    //     8.
    SharePointGroup = 0x8,
    // Summary:
    //     Enumeration whose value specifies all principal types. Value = 15.
    All = 0xF

As far as I know, Office 365 groups & Security groups cannot be used directly but can be added to a SharePoint Group. The containing SharePoint Group can then be used to set permission on SharePoint objects (like libraries, items, files, folders).

"None" and "All" are special values, you usually do not need to use those. "User" and "SharePointGroup" are the most frequently used, matching the most common grant permission tasks we do manually on web interface. "DistributionList" and "SecurityGroups" are two types of user groups our Microsoft 365 administrator can create and manage in Microsoft 365 Admin Center (details here). Instead of SharePoint Groups, that are visible only within a single SharePoint Site Collection, "DistributionList" and "SecurityGroups" are visible and can be used accross all the SharePoint site collections and any other Microsoft 365 service ("DistributionList" and "SecurityGroups" are stored in Azure Active Directory).

Programmaticaly speaking "SecurityGroups" are considered as a special type of user (see here). You can add/ensure a security group to SharePoint and keep its Id and manage it like every other principal type:

// security group
var securityGroup = await context.Web.EnsureUserAsync(securityGroupName);
var securityGroupId = securityGroup.Id;
await subFolder.ListItemAllFields.AddRoleDefinitionAsync(securityGroupId, editRole);
  • ok thanks for the details reply... so if i need to add Office 365 group or security group to a folder permission what i need to do?
    – John John
    Feb 18, 2023 at 21:49
  • also can you please explain the code sample you provided what are those codes?
    – John John
    Feb 18, 2023 at 21:57
  • @NETCoreSharePoint I extended the answer. Enjoy the SharePoint journey! Feb 19, 2023 at 10:04
  • so i can add office 365 group + security groups using the code ?
    – John John
    Feb 19, 2023 at 20:08
  • The code sample I included worked for me. I successfully added a Security Group to folder permissions like I've done with a user. I never tried with Office365 Groups. Feb 20, 2023 at 8:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.