我们有一个SharePoint Online网站，其中包含许多子网站，每个子网站都有一个包含15个文件夹的文档库。我们要为每个文件夹设置不同的Active Directory同步安全组的不同权限。 例如
Group1 Group2 Group3
Folder1 RO RO RW
Folder2 NA RW RO
..
Folder15 RW RW RO
（RO：只读，RW：读写，NA：无访问权限）
为此，我们首先需要打破来自其父母的文件夹的继承，我设法使用此PS代码实现了这一点，其中SPOMod.psm1可在此处免费在线获得https://gallery.technet.microsoft.com/office/SharePoint-Module-for-5ecbbcf0
$cred=Get-Credential
Import-Module "D:\somepath\SharePoint Onlince Client Components SDK\SPOMod.psm1" -verbose
Connect-SPOCSOM -Credential $cred -Url "https://companyname.sharepoint.com/sites/Projects_Division/ProjectnameAndLocation"
Get-SPOListItems -ListTitle Documents -Recursive -IncludeAllProperties $true | select ID
Remove-SPOListItemInheritance -ListTitle Documents -KeepPermissions $false -ItemID 1
Remove-SPOListItemInheritance -ListTitle Documents -KeepPermissions $false -ItemID 2
Remove-SPOListItemInheritance -ListTitle Documents -KeepPermissions $false -ItemID 3
Remove-SPOListItemInheritance -ListTitle Documents -KeepPermissions $false -ItemID 4
Remove-SPOListItemInheritance -ListTitle Documents -KeepPermissions $false -ItemID 5
Remove-SPOListItemInheritance -ListTitle Documents -KeepPermissions $false -ItemID 6
Remove-SPOListItemInheritance -ListTitle Documents -KeepPermissions $false -ItemID 7
Remove-SPOListItemInheritance -ListTitle Documents -KeepPermissions $false -ItemID 8
Remove-SPOListItemInheritance -ListTitle Documents -KeepPermissions $false -ItemID 9
Remove-SPOListItemInheritance -ListTitle Documents -KeepPermissions $false -ItemID 10
Remove-SPOListItemInheritance -ListTitle Documents -KeepPermissions $false -ItemID 11
Remove-SPOListItemInheritance -ListTitle Documents -KeepPermissions $false -ItemID 12
Remove-SPOListItemInheritance -ListTitle Documents -KeepPermissions $false -ItemID 13
Remove-SPOListItemInheritance -ListTitle Documents -KeepPermissions $false -ItemID 14
Remove-SPOListItemInheritance -ListTitle Documents -KeepPermissions $false -ItemID 15
其中ItemID 1至15是在此库上首次创建的文件夹ID。 这对我来说很好。
#Load SharePoint CSOM Assemblies
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.dll"
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.Runtime.dll"
#Variables
$SiteURL="https://companyname.sharepoint.com/sites/Projects_Division/Project1nameAndLocation"
$FolderURL="Documents/Folder1" #Relative URL of the 1st Folder
$GroupName="ActiveDirectory Group1 Name" #The AD Group that we want to assign for Folder1
$UserAccount="useraccount@company.com" An AD Account that we want to also assign
$PermissionLevel="Read"
$Cred= Get-Credential
$Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($Cred.Username, $Cred.Password)
#Setup the context
$Ctx = New-Object Microsoft.SharePoint.Client.ClientContext($SiteURL)
$Ctx.Credentials = $Credentials
$Web = $Ctx.web
#Get the Folder
$Folder = $Web.GetFolderByServerRelativeUrl($FolderURL)
$Ctx.Load($Folder)
$Ctx.ExecuteQuery()
#Break Permission inheritence - Remove all existing list permissions & keep Item level permissions
$Folder.ListItemAllFields.BreakRoleInheritance($False,$True)
$Ctx.ExecuteQuery()
Write-host -f Yellow "Folder's Permission inheritance broken..."
#Get the SharePoint Group & User
$Group =$Web.SiteGroups.GetByName($GroupName)
$User = $Web.EnsureUser($UserAccount)
$Ctx.load($Group)
$Ctx.load($User)
$Ctx.ExecuteQuery() #The error is happening here and the script stopps
#Grant permission
#Get the role required
$Role = $web.RoleDefinitions.GetByName($PermissionLevel)
$RoleDB = New-Object Microsoft.SharePoint.Client.RoleDefinitionBindingCollection($Ctx)
$RoleDB.Add($Role)
#Assign permissions
$GroupPermissions = $Folder.ListItemAllFields.RoleAssignments.Add($Group,$RoleDB)
$UserPermissions = $Folder.ListItemAllFields.RoleAssignments.Add($User,$RoleDB)
$Folder.Update()
$Ctx.ExecuteQuery()
Write-host "Permission Granted Successfully!" -ForegroundColor Green
-----
在执行查询时，我在#Get SharePoint组和用户处遇到错误：
------
PS C:\Users\user\Desktop\code> $Ctx.ExecuteQuery()
Exception calling "ExecuteQuery" with "0" argument(s): "Group cannot be found."
At line:1 char:5
+ $Ctx.ExecuteQuery()
+ ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : ServerException
----
尽管该组已成功进行AD同步，但是如果我尝试通过GUI进行操作，它将显示在SharePoint GUI中。
如果该组是本地SharePoint Online组（而不是AD同步的），我注意到并测试该代码是否可以正常工作？是否有命令允许我以相同方式使用AD同步组？
答案 0 :(得分：0)
$ Group = $ Web.SiteGroups.GetByName（$ GroupName）仅获取SharePoint组。
使用： $ ADGroup = $ Web.EnsureUser（“ Domain \ ADGroup”）来解析广告组！