0

need to check permissions for a specific user on SharePoint Online 2013 thoughout the sites need powershell commands to achieve this

3

Like Nico said, we need more information as to what you're looking for. This will work with SPO, but requires that you have the necessary dll's from the 15 hive from a server installation. This can be tweaked to iterate through sites and to take a name, rather than the current user:

$cSharp = @"
using System;
using System.Management.Automation;
using System.Security;
using Microsoft.SharePoint.Client;
using Microsoft.SharePoint.Client.Utilities;

namespace SPClient
{
    public class SharePointPS
    {
        public static void Main()
        {
            using ( ClientContext ctx = new ClientContext( "https://tenant.sharepoint.com/sites/mySite/" ) )
            {
                var web = ctx.Web;
                var currentUser = web.CurrentUser;
                Console.Write( "Enter your username: " );
                String userName = Console.ReadLine();
                SecureString password = GetPassword();
                ctx.Credentials = new SharePointOnlineCredentials( userName, password );
                ctx.Load( web, w => w.CurrentUser );
                ctx.Load( web.RoleAssignments, collection => collection.Include(ra => ra.Member) );
                ctx.ExecuteQuery();
                RoleAssignmentCollection raColl = web.RoleAssignments;
                foreach ( RoleAssignment ra in raColl )
                    if(ra.Member.PrincipalType == PrincipalType.SharePointGroup)
                    {
                        Group group = ra.Member as Group;
                        ctx.Load( group.Users );
                        ctx.ExecuteQuery();
                        foreach(User userInGroup in group.Users)
                            if ( userInGroup.LoginName == currentUser.LoginName )
                                DisplayPermissionLevel(ra, ctx, group.Title);
                    } else if ( ra.Member.PrincipalType == PrincipalType.User )
                    {
                        User user = ra.Member as User;
                        if ( user.LoginName == currentUser.LoginName )
                            DisplayPermissionLevel( ra, ctx, null );
                    }
            }
        }

        private static void DisplayPermissionLevel( RoleAssignment ra, ClientContext ctx, String groupName )
        {
            RoleDefinitionBindingCollection rdbc = ra.RoleDefinitionBindings;
            ctx.Load( rdbc );
            ctx.ExecuteQuery();
            for ( Int32 i = 0; i < rdbc.Count; i++ )
                Console.WriteLine( "User is granted the {0} permission level{1}", rdbc[i].Name, ( groupName == null ? " directly." : " by the group: " + groupName ) );
        }

        private static SecureString GetPassword()
        {
            Console.Write( "Password: " );
            SecureString secPass = new SecureString();
            ConsoleKeyInfo cki = Console.ReadKey( true );
            while(cki.Key != ConsoleKey.Enter)
            {
                if(cki.Key != ConsoleKey.Backspace)
                {
                    Console.Write( "*" );
                    secPass.AppendChar( cki.KeyChar );
                } else if ( cki.Key == ConsoleKey.Backspace )
                {
                    if ( secPass.Length != 0 )
                    {
                        secPass.RemoveAt( secPass.Length - 1 );

                        Int32 pos = Console.CursorLeft;
                        Console.SetCursorPosition( pos - 1, Console.CursorTop );
                        Console.Write( " " );
                        Console.SetCursorPosition( pos - 1, Console.CursorTop );
                    }
                }
                cki = Console.ReadKey( true );
            }
            secPass.MakeReadOnly();
            Console.WriteLine();
            return secPass;
        }
    }
}
"@

$path = "path to folder containing dll's (e.g.,ISAPI folder in 15 Hive)"
$assemblies = @(
"$path\Microsoft.SharePoint.Client.dll",
"$path\Microsoft.SharePoint.Client.Runtime.dll"
"System.Core"
)

Add-Type -TypeDefinition $cSharp -ReferencedAssemblies $assemblies
[SPClient.SharePointPS]::Main()

It iterates through all the RoleAssignments in Web.RoleAssignments, checks whether the user is affected by the RoleAssignment, and if so, displays the permission level. It outputs something along the following: "User is granted the Limited Access permission level by the group: Style Resource Readers", or, "User is granted the Limited Access permission level directly." if the permission is given directly to the user, and not to a group the user belongs to.

If you do not have them, here is the SPO PowerShell cmdlets that can accomplish something similar (will only get the permission level granted to the group on the root web of the site collection, and will not get permissions that are granted directly to a user, only to a group!).

$url = "https://tenant-admin.sharepoint.com"
$spoCred = Get-Credential
Connect-SPOService -Url $url -Credential $spoCred
$site = Get-SPOSite https://tenant.sharepoint.com/sites/mySite
$user = Get-SPOUser -Site $site -LoginName "user@tenant.onmicrosoft.com"
$user.Groups | Foreach-Object {
    $group = Get-SPOSiteGroup -Site $site -Group $_
    Write-Host "$($user.DisplayName) has these roles from $($group.LoginName):"
    $group.Roles
}
0

What kind of permissions are you looking for ? permissions on documents libraries ? or in sites themselves ?

You just need to get your web app, then loop in all sites and finally get the user permission.

Maybe this can help you by using Get-SPUser cmdlet.

Or easier way :

$urlWeb = "http://mycompany/sites/mydepartment"
Get-SPUser -Web $urlWeb | select UserLogin, @{name=”Exlicit given roles”;expression={$_.Roles}}, @{name=”Roles given via groups”;expression={$_.Groups | %{$_.Roles}}},Groups | format-Table -auto

Where you can filter the output by UserLogin, accoding to this site.

  • Server side code will not work in SharePoint Online. – wjervis Apr 30 '14 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.