Error granting permissions to a folder in a document library in Sharepoint via PowerShell

Sebastian Biały 40 Reputation points
2024-11-07T14:28:53.7233333+00:00

I plan to create a file exchange in the document library where everyone can only see their folder and only within that folder have the ability to share files outside the organization.

I have created a script that creates a folder in the document library, breaks its inheritance, removes existing folder permissions, and assigns permissions to a particular user via csv.

The site is prepared as follows:

From sharepoint admin -> file_exchange site -> in members tab I add users not in any group

Site members tab - Sharepoint group in which there is a domain group in which all users are, as below

Site permissions:

Domain group in which there are all users - Read

Sharepoint group in which there is a domain group in which there are all users, as above - Read

Site Owners group - Full control

Library permissions

Sharepoint group in which there is a domain group in which there are all users, as above - Read

Site Owners group - Full control

On each folder created by the script is the permission for the user to edit

Everything creates fine except for the last step, which is to grant permissions for a given user via csv. Through powershell (pnp.powershell) I get a message that the user was not found. The problem is that when I go into the library permissions -> check permissions and enter the user in question, I get the message:

Limited Access Given directly

Read Given through the “All_Access_Exchange” group.

Weirdest, when I run the script again after clicking “check permissions” the permissions are given correctly. This happens every time and on every user entered.

Below I send the script I use and a sample of one user in a csv file:

$SiteURL = "MY SITE"

$CSVFilePath = "C:\DATA.csv"

$LibraryName = "Shared Documents"

$CSVFile = Import-Csv $CSVFilePath

ForEach ($Row in $CSVFile) {

$FolderName = $Row.FolderName

$FolderName = [RegEx]::Replace($FolderName, "[{0}]" -f ([RegEx]::Escape([String]'\"*:<>?/\|')), '_')

$Folder = Add-PnPFolder -Name $FolderName -Folder $LibraryName

Write-Host "Folder created:" $FolderName -ForegroundColor Green

$FolderItem = Get-PnPListItem -List $LibraryName -Query "<View><Query><Where><Eq><FieldRef Name='FileLeafRef'/><Value Type='Text'>$FolderName</Value></Eq></Where></Query></View>"

if ($FolderItem) {

    $FolderItem.BreakRoleInheritance($true, $false)

    Invoke-PnPQuery

    Write-Host "Inheritance break for:" $FolderName -ForegroundColor Yellow

    $RoleAssignments = Get-PnPProperty -ClientObject $FolderItem -Property RoleAssignments

    $RoleAssignments | ForEach-Object {

        $_.RoleDefinitionBindings.RemoveAll()

        $_.Update()

    }

    Invoke-PnPQuery

    Write-Host "Permission deleted for:" $FolderName -ForegroundColor Red

    $UserName = $Row.UserName

    $User = Get-PnPUser -Identity $UserName

    if ($User) {

        set-PnPListItemPermission -List $LibraryName -Identity $FolderItem.Id -User $UserName -AddRole "Contribute"

        Write-Host "Permission granted for:" $UserName -ForegroundColor Green

    } else {

        Write-Host "Cant`f find user:" $UserName -ForegroundColor Red

    }

} else {

    Write-Host "Can`t find folder:" $FolderName -ForegroundColor Red

}
```}

CSV

foldername,username

001_name_lastname,i:0#.f|membership|user@domain.com.pl

Microsoft 365
Microsoft 365
Formerly Office 365, is a line of subscription services offered by Microsoft which adds to and includes the Microsoft Office product line.
5,276 questions
SharePoint Development
SharePoint Development
SharePoint: A group of Microsoft Products and technologies used for sharing and managing content, knowledge, and applications.Development: The process of researching, productizing, and refining new or existing technologies.
3,122 questions
PowerShell
PowerShell
A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
2,676 questions
0 comments No comments
{count} votes

Accepted answer
  1. Ling Zhou_MSFT 19,170 Reputation points Microsoft Vendor
    2024-11-08T06:37:13.1266667+00:00

    Hi @Sebastian Biały

    Let's focus on the line of command where you get the user.

    User's image

    I checked the documentation for the command, and nothing went wrong with your command. Then I tested it on my end:

    User's image

    User's image

    I succeeded in getting users. So, I suspect something is wrong with the value of the username in your csv file. Please perform a check.

    Please refer to the official documentation for an example:

    User's image

    If that doesn't work, you can try using an email address to get the address. I've tested it and it works.

    User's image

    There's nothing wrong with your code, just the username value needs to be checked. I used your code exactly and I managed to create the folder and give permissions in one go.

    User's image

    User's image


    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.