Sunday, November 12, 2017

SharePoint Online: Grant Permission to List Item using PowerShell

Permissions are hierarchical in SharePoint from Top Site collection till the List Item level. To set unique permissions on list items, you need to configure permissions on item level. Here is how:

How to Grant Access to Individual List Items in SharePoint Online?
Got a business requirement to grant permissions at List item level. To set explicit permissions on SharePoint online list items, we need to break the permission inheritance first (stop inheriting permissions) and then add user or group to the List Item.

  • Go to your SharePoint Online list or library >> Select the Item to which you want to provide unique permissions. 
  • Click on "Shared With" button from the ribbon. On the Shared With page, click Advanced.
    set item level permission in sharepoint online
  • On the Permissions tab, in the Inheritance group, click Stop Inheriting Permissions button. Confirm the prompt.
    sharepoint online list item permissions powershell
  • Now, from the ribbon, click on "Grant Permissions." button. In the Share dialog box, enter names, email addresses. Click the Show Options button. In the Select A Permission Level list box, select appropriate permission level such as Edit.
    powershell to grant permission to list item in sharepoint online
  • Click Share.
Having too many Item level permissions often leads to performance issues! so, be careful.

SharePoint Online: Set List Item Permissions using PowerShell:
#Load SharePoint CSOM Assemblies
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.dll"
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.Runtime.dll"

#To call non-generic method Load(list, x => x.HasUniqueRoleAssignments)
Function Invoke-LoadMethod() {
    param(
            [Microsoft.SharePoint.Client.ClientObject]$Object = $(throw "Please provide a Client Object"),
            [string]$PropertyName
        ) 
   $ctx = $Object.Context
   $load = [Microsoft.SharePoint.Client.ClientContext].GetMethod("Load") 
   $type = $Object.GetType()
   $clientLoad = $load.MakeGenericMethod($type)

   $Parameter = [System.Linq.Expressions.Expression]::Parameter(($type), $type.Name)
   $Expression = [System.Linq.Expressions.Expression]::Lambda([System.Linq.Expressions.Expression]::Convert([System.Linq.Expressions.Expression]::PropertyOrField($Parameter,$PropertyName),[System.Object] ), $($Parameter))
   $ExpressionArray = [System.Array]::CreateInstance($Expression.GetType(), 1)
   $ExpressionArray.SetValue($Expression, 0)
   $clientLoad.Invoke($ctx,@($Object,$ExpressionArray))
}

Function Set-ListItemPermission
{
    param
    (   
        [Parameter(Mandatory=$true)] [string]$SiteURL,
        [Parameter(Mandatory=$true)] [string]$ListName,
        [Parameter(Mandatory=$true)] [string]$ItemID,
        [Parameter(Mandatory=$true)] [string]$PermissionLevel,
        [Parameter(Mandatory=$true)] [string]$UserID
    )
    Try {
        #Setup Credentials to connect
        $Cred= Get-Credential
        $Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($Cred.Username, $Cred.Password)

        #Setup the context
        $Ctx = New-Object Microsoft.SharePoint.Client.ClientContext($SiteURL)
        $Ctx.Credentials = $Credentials
        
        #Get the List and Item
        $List = $Ctx.Web.Lists.GetByTitle($ListName)
        $ListItem=$List.GetItemByID($ItemID)
        $Ctx.Load($List)
        $Ctx.Load($ListItem)
        $Ctx.ExecuteQuery()

        #Check if Item has unique permission already
        Invoke-LoadMethod -Object $list -PropertyName "HasUniqueRoleAssignments"
        $Ctx.ExecuteQuery()

        #Break Item's permision Inheritance, if its inheriting permissions from the parent
        if (-not $ListItem.HasUniqueRoleAssignments)
        {
            $ListItem.BreakRoleInheritance($false, $false) #keep the existing permissions: No -  Clear listitems permissions: No
            $ctx.ExecuteQuery()
        }

        #Get the User
        $User = $Ctx.Web.EnsureUser($UserID)
        $Ctx.load($User)
        $Ctx.ExecuteQuery()

        #Get the role 
        $Role = $Ctx.web.RoleDefinitions.GetByName($PermissionLevel)
        $RoleDB = New-Object Microsoft.SharePoint.Client.RoleDefinitionBindingCollection($Ctx)
        $RoleDB.Add($Role)
         
        #Assign permissions
        $UserPermissions = $ListItem.RoleAssignments.Add($User,$RoleDB)
        $ListItem.Update()
        $Ctx.ExecuteQuery()
    
        Write-host -f Green "Permission granted to List Item successfully!"
    }
    Catch {
        Write-host -f Red "Error granting permission to List Item!" $_.Exception.Message
    }
}

#Set parameter values
$SiteURL="https://crescent.sharepoint.com"
$ListName="Projects"
$ItemID="1"
$UserID="salaudeen@crescent.com"
$PermissionLevel="Edit"

#Call the function
Set-ListItemPermission -SiteURL $SiteURL -ListName $ListName -ItemID $ItemID -UserID $UserID -PermissionLevel $PermissionLevel 

This script grants permission on Item level for given user. If you want to provide permission to SharePoint Group, Instead of line
$User = $Web.EnsureUser($UserAccount)
#use:
$Group =$Web.SiteGroups.GetByName($GroupName)
#and then
$GroupPermissions = $Item.RoleAssignments.Add($Group,$RoleDB)



You might also like:
SharePoint Usage Reports
Usage reports, collaboration and audit for SharePoint.
Document SharePoint Farm
Automatically generate SharePoint documentation.
*Sponsored


Check out these SharePoint products:

No comments :

Post a Comment

Please Login and comment to get your questions answered!


You might also like:

Related Posts Plugin for WordPress, Blogger...