SharePoint - How to Reset Inheritance Permission set into an SP DocLib folder or file

When we are importing File Server content into SharePoint using dedicated tools for, we can import permission set configured at the sub levels (subfolders or documents). That import can create some issues due to incorrect configuration in place on original File Server.

But how can we check one user complaining to not see or access the content as it was into the File Server ?

That need to be reviewed at any SharePoint Content Level with Permission Management with "Administrator Permission" with the link "Manage Access".

You have to select the link (at the bottom) "Advanced" to have the exact permission set configured at this level 

Based on that situation, you can decide what to apply at this folder or file level. You can:

• add a colleague or a group with appropriate permission (Read, Write or full control)
• Remove the specific permission of that level clicking on "Delete unique permissions"

But this config could concern many other sublevels and wait the user complains is probably not the best option.

How to track folders or files with unique permissions ?

You can do that using the Document Library Permission Settings from:

• Library Settings > "Permissions for this Document Library"

You will have the permission configuration in place at this root Document library level.

But the first line will explain (if that is the case into your document library) the status of sublevel:

• Some items of this list may have unique permissions which are not controlled from this page.  Show these items.

When you are clicking on that link it will show you a part of customized levels.

You can change the permission set for each of those level clicking on "Manage Permissions" to have the same details we look in the first part of this message. 

Now as you can imagine with a document library could contains thousands of folders, this manual action is really huge.

How reset all customized permissions configured at sublevel ?

That is the best option you can select as site admin, using PowerShell and an interesting PS Module named:

• SharePointPnPPowerShellOnline

This following script will help IT Team to reconfigure all content customized into the document library and cancel this and reconfigure permission inheritance instead.

#install-module SharePointPnPPowerShellOnline -Force #to install that module the first time only
Write-Host " ---------------------------------------------- "
Import-Module SharePointPnPPowerShellOnline
Write-Host " ---------------------------------------------- "

#Config Variables
$SiteURL = "https://yourtenant.sharepoint.com/sites/YourSiteCollection/"
$ListTitle = "Document Library Name"

$foldertoscope = "/sites/YourSiteCollection/YourDocumentLibrary/"

#Connect to PnP Online
Connect-PnPOnline -Url $SiteURL -UseWebLogin

$ctx = Get-PnPContext

  $ctx.Load($ctx.Web.Lists)
  $ctx.Load($ctx.Web)
  $ctx.Load($ctx.Web.Webs)
  $ctx.ExecuteQuery()
  $ll=$ctx.Web.Lists.GetByTitle($ListTitle)
  $ctx.Load($ll)
  $ctx.ExecuteQuery()

  ## View XML
$qCommand = @"
<View Scope="RecursiveAll">
    <Query>
        <OrderBy><FieldRef Name='ID' Ascending='TRUE'/></OrderBy>
    </Query>
    <RowLimit Paged="TRUE">5000</RowLimit>
</View>
"@
## Page Position
$position = $null
 
## All Items
$allItems = @()
Do{
    $camlQuery = New-Object Microsoft.SharePoint.Client.CamlQuery
    $camlQuery.ListItemCollectionPosition = $position
    $camlQuery.ViewXml = $qCommand
 ## Executing the query
    $currentCollection = $ll.GetItems($camlQuery)
    $ctx.Load($currentCollection)
    $ctx.ExecuteQuery()
 
 ## Getting the position of the previous page
    $position = $currentCollection.ListItemCollectionPosition
 
 # Adding current collection to the allItems collection
    $allItems += $currentCollection

     Write-Host "Collecting items. Current number of items: " $allItems.Count
}
while($position -ne $null)

Write-Host "Total number of items: " $allItems.Count

for($j=0;$j -lt $allItems.Count ;$j++)
{
    if($allItems[$j]["FileRef"].StartsWith($foldertoscope))
    {
        Write-Host "Resetting permissions for " $allItems[$j]["Title"] ".." $allItems[$j]["FileRef"]
        $allItems[$j].ResetRoleInheritance()
        $ctx.ExecuteQuery()
    }
}

Now you can adapt the permissions as much as you need to

Fabrice Romelard