#Function to Get Permissions on a particular on List, Folder or List Item Function Get-PnPPermissions([Microsoft.SharePoint.Client.SecurableObject]$Object) { $ParentUrl = "" $Id = "" #Determine the type of the object Switch($Object.TypedObject.ToString()) { "Microsoft.SharePoint.Client.ListItem" { If($Object.FileSystemObjectType -eq "Folder") { $ObjectType = "Folder" $Id = $Object.Id #Get the URL of the Folder $Folder = Get-PnPProperty -ClientObject $Object -Property Folder $ObjectTitle = $Object.Folder.Name $ObjectURL = $Object.Folder.ServerRelativeUrl $ParentUrl = (Split-Path $ObjectURL -Parent).Replace("\","/") } Else #File or List Item { #Get the URL of the Object Get-PnPProperty -ClientObject $Object -Property File, ParentList If($Object.File.Name -ne $Null) { $ObjectType = "File" $Id = $Object.Id $ObjectTitle = $Object.File.Name $ObjectURL = $Object.File.ServerRelativeUrl $ParentUrl = (Split-Path $ObjectURL -Parent).Replace("\","/") } else { $ObjectType = "List Item" $Id = $Object.Id $ObjectTitle = $Object["Title"] #Get the URL of the List Item $DefaultDisplayFormUrl = Get-PnPProperty -ClientObject $Object.ParentList -Property DefaultDisplayFormUrl $ObjectURL = $("{0}?ID={1}" -f $DefaultDisplayFormUrl,$Object.ID) } } } Default { $ObjectType = "List or Library" $ObjectTitle = $Object.Title $Id = $Object.Id #Get the URL of the List or Library $RootFolder = Get-PnPProperty -ClientObject $Object -Property RootFolder $ObjectURL = $RootFolder.ServerRelativeUrl } } #Get permissions assigned to the object Get-PnPProperty -ClientObject $Object -Property HasUniqueRoleAssignments, RoleAssignments #Check if Object has unique permissions $HasUniquePermissions = $Object.HasUniqueRoleAssignments #Loop through each permission assigned and extract details $PermissionCollection = @() Foreach($RoleAssignment in $Object.RoleAssignments) { #Get the Permission Levels assigned and Member Get-PnPProperty -ClientObject $RoleAssignment -Property RoleDefinitionBindings, Member #Get the Principal Type: User, SP Group, AD Group $PermissionType = $RoleAssignment.Member.PrincipalType #Get the Permission Levels assigned $PermissionLevels = $RoleAssignment.RoleDefinitionBindings | Select -ExpandProperty Name #Remove Limited Access $PermissionLevels = ($PermissionLevels | Where { $_ -ne "Limited Access"}) -join "," #Leave Principals with no Permissions If($PermissionLevels.Length -eq 0) {Continue} #Get SharePoint group members If($PermissionType -eq "SharePointGroup") { #Get Group Members $GroupMembers = Get-PnPGroupMember -Identity $RoleAssignment.Member.LoginName #Leave Empty Groups If($GroupMembers.count -eq 0){Continue} $GroupUsers = ($GroupMembers | Select -ExpandProperty Title) -join "; " #Add the Data to Object $Permissions = New-Object PSObject $Permissions | Add-Member NoteProperty ObjectId($Id) $Permissions | Add-Member NoteProperty Object($ObjectType) $Permissions | Add-Member NoteProperty Title($ObjectTitle) $Permissions | Add-Member NoteProperty URL($ObjectURL) $Permissions | Add-Member NoteProperty ParentURL($ParentURL) $Permissions | Add-Member NoteProperty HasUniquePermissions($HasUniquePermissions) $Permissions | Add-Member NoteProperty Users($GroupUsers) $Permissions | Add-Member NoteProperty Type($PermissionType) $Permissions | Add-Member NoteProperty Permissions($PermissionLevels) $Permissions | Add-Member NoteProperty GrantedThrough("SharePoint Group: $($RoleAssignment.Member.LoginName)") $PermissionCollection += $Permissions } Else { #Add the Data to Object $Permissions = New-Object PSObject $Permissions | Add-Member NoteProperty ObjectId($Id) $Permissions | Add-Member NoteProperty Object($ObjectType) $Permissions | Add-Member NoteProperty Title($ObjectTitle) $Permissions | Add-Member NoteProperty URL($ObjectURL) $Permissions | Add-Member NoteProperty ParentURL($ParentURL) $Permissions | Add-Member NoteProperty HasUniquePermissions($HasUniquePermissions) $Permissions | Add-Member NoteProperty Users($RoleAssignment.Member.Title) $Permissions | Add-Member NoteProperty Type($PermissionType) $Permissions | Add-Member NoteProperty Permissions($PermissionLevels) $Permissions | Add-Member NoteProperty GrantedThrough("Direct Permissions") $PermissionCollection += $Permissions } } return $PermissionCollection } function Check-Permission { param( $DocumentLib, $FolderName ) $folderPermission = @() #Get the Context $Context = Get-PnPContext $List = Get-PnpList -Identity $DocumentLib -Includes RoleAssignments $folderPermission += Get-PnPPermissions $List if($FolderName -eq "") { $ListItems = Get-PnPListItem -List $List -PageSize 500 } else { $ParentItem = Get-PnpListItem -List "Shared Documents" | Where-Object {$_.FieldValues.FileRef -eq "/$($DocumentLib)/$FolderName"} $folderPermission += Get-PnPPermissions -Object $ParentItem $ListItems = Get-PnPListItem -List $List -PageSize 500 -FolderServerRelativeUrl "/$($DocumentLib)/$FolderName" } ForEach($ListItem in $ListItems) { $folderPermission += Get-PnPPermissions -Object $ListItem } $FilesOrFolderWithUP = $folderPermission | Where-Object {$_.HasUniquePermissions -eq $true} $GroupedObject = $FilesOrFolderWithUP | Group-Object -Property "URL" foreach($GroupObj in $GroupedObject) { if($GroupObj.Group[0].ParentUrl -ne $null -and $GroupObj.Group[0].ParentUrl -ne "") { $ParentObject = $folderPermission | Where-Object {$_.URL -eq $GroupObj.Group[0].ParentUrl} | Group-Object -Property "URL" $Result = Compare-Object -ReferenceObject $ParentObject.Group -DifferenceObject $GroupObj.Group if($Result -eq $null) { $GroupObj.Group[0].Url #Set-PnPListItemPermission -List $GroupObj.Group[0].Url -Identity $GroupObj.Group[0].Url -InheritPermissions $Item = Get-PnPListItem -List "Shared Documents" | Where-Object {$_.FieldValues.FileRef -eq "$($GroupObj.Group[0].Url)"} #sharepoint online delete unique permissions powershell $Item.ResetRoleInheritance() $Item.Update() $Context.ExecuteQuery() Write-Host "The $($GroupObj.Group[0].Url) unique permission has been stopped" -ForegroundColor Green } } } } $SiteURL = "https://domain.sharepoint.com" $DocumentLibrary = "Document Name" $FolderName = "Test" #Connect to SharePoint Online Connect-PnPOnline $SiteURL -UseWebLogin Check-Permission -DocumentLib "$($DocumentLibrary)" -FolderName $($FolderName)