how to remove inheritance permission from folders for a specific group?

[rakib1]

Hi,

i am trying to remove/stop the inheritance permission from folder for a specific group as soon as created into document library. i am assuming first i need to break the inheritance and then remove that specific group permission from folder. could you please help me with steps?

Thanks in advanced

i was trying to use below steps but not working. any idea what i need to change so it will break inheritance as well remove permission for specific group.

[NiloferA · Accepted solution]

To achieve this you will have to follow below steps

1. Send an HTTP Request to Break Role Inheritance
   1. 

      _api/web/GetFolderByServerRelativeUrl('Shared%20Documents/Test')/ListItemAllFields/breakroleinheritance(copyRoleAssignments=true,clearSubscopes=true)

2. Send an HTTP Request to Remove the Group Permissions
   1. 

      _api/web/GetFolderByServerRelativeUrl('Shared%20Documents/Test')/ListItemAllFields/RoleAssignments/groups/RemoveByLoginName('Name of the Sharepoint Group')

Please remember while sending API requests, you need to specify the Name that appears in the URL for Libraries/Lists when you access them

Hope this helps!

[rakib1]

Hello NiloferA,

Thanks for your reply. i have another question related to this thread. as this flow only will remove newly created folder permission but how about existing folder permission. will that specific group permission will remove from all newly created folder as well existing folder? i think answer is No, because we started with action "When a file is created ". what i need to change with the flow to make it happen?

Thanks again

[NiloferA]

If you want to Break Permissions for all the Folders in the library, you can do something like this, but then you have to think when does this Flow need to be triggered. I am triggering this Flow manually on a button click.

1. Add a Send an HTTP Request to SharePoint Action to get all the Folders in your Library
   1. 
   2. _api/web/lists/GetByTitle('Documents')/rootFolder/Folders
2. Use Select action to get the names of all the Folders in an Array
   1. 

   2. From: outputs('Send_an_HTTP_request_to_SharePoint_3')?['body']['d']['results']

   3. Map section - key: Name; value: item()?['Name']

3. Now, I was getting some "Forms" folder, along with my other folders, which I never created but I think might be some kind of internal Folder which I do not want to work on. So, I used skip function to remove the first item from my Array which was Forms
   1. 
   2. skip(body('Select'),1)
4. Then add an Apply to each action, add the Array to iterate on it
5. Inside Apply to each, add the Send an HTTP Action to break role inheritance 
6. After breaking the permissions, add Send an HTTP Action to remove the specific Group permissions
   1. 

Hope this should clarify your question.

Just one thing to remember, the Remove Group Permissions will give you an error if the Group Permissions have already been removed. So you will have to add a condition to see whether the Group has access on the Folder or not, if yes only then remove the permissions for this group. Let me know if you need help here as well.

[rakib1]

Hello,

appreciated for your help. actually my scenario is i have already library with many folders and subfolders and has removed that specific group from library level. Now i need to reassign read permission for this specific group at library level then i am assuming it will inherit that group again to all folders and sub-folders. if that is the case then i need to remove that group only from all existing and newly created folders going forward. Based on my scenario,  do you think above solution will work? Basically we need some mechanism that will check each and every folder for that specific group and if find just remove it. but group should still remain in the library level.

[rakib1]

Hello NilferA,

i am receiving the below error. any idea please

[NiloferA]

Hello @rakib1,

I understand your scenario, please find below my answers to your questions

1. Yes this solution will work for you as we are only Removing the permissions for a group from the Root Folder and not the Library. Your group will still remain on the Library level with the permissions you have provided. Please note that the api we are hitting only gives you the Root folders and not the Sub Folders.
2. Your next concern of this solution working for existing and new folders, you can create a manual trigger first and run the Flow on all the folders as I have shown above. That will take care of all the existing root folders in your library.
3. Next, replace the manual trigger with "When a file is created" trigger and only keep the Send an HTTP Request to SharePoint actions for breaking inheritance and remove group permissions (remove the actions added for looping), so from now on every time a new file is created, your Flow will execute and take care of permissions for the newly created folders.
4. For Your issue you posted above, I may have missed out a point where you have to provide the Name of the folder in the URI of both the Send an HTTP request to SharePoint actions within Apply to each as shown in the below screenshot
   1. 
   2. The Expression in the image is - item()?['Name']
   3. URI is - _api/web/GetFolderByServerRelativeUrl('Shared%20Documents/expression in (b)')/ListItemAllFields/breakroleinheritance(copyRoleAssignments=true,clearSubscopes=true)
   4. URI for Removing Permissions for the Group - _api/web/GetFolderByServerRelativeUrl('Shared%20Documents/expression in (b)')/ListItemAllFields/RoleAssignments/groups/RemoveByLoginName('Check Permissions')

Please Post a Reply if there are further questions.

[rakib1]

Hello NiloferA,

its seems to me working but getting error though like below screen shot. any idea please?

[NiloferA]

If you see the error, it says that you are trying to remove the permissions for "Forms" folder which is a hidden folder and this action is not allowed. Please try removing this folder from your array of folder names and try again.

If you need help how to remove items from the array, you can check it in my reply above or refer this post here https://powerusers.microsoft.com/t5/Building-Flows/Skip-Array-Indexes/td-p/482993 

[emberkrumwied]

Trying to implement this solution to skip the system folder "Forms", however it is not the first item returned like in the example above it is the 3rd item.  My library has 4 items and if I use skip(body('Select'),3) it will only return the 4th item.  So what would the expression be to return items 1, 2, & 4?

[Hawkeye_Keenan]

This solution works for SharePoint security groups, but it does not work removing Office 365 Groups/domain groups. Do have the api to handle O365 groups? Do I need to use a different Send an Http action?

[jdaniel_dyn365]

This is exactly what I need, but in my code, the solution isn't erroring out, but its not working ether. its just outputting a false result:

{
  "d": {
    "BreakRoleInheritance": null
  }
}

The uri field I used the following:

_api/web/GetFolderByServerRelativeUrl('Shared Documents/1002 - Test 2 Reversed Security/Test 1 - Reversed Shared')/ListItemAllFields/breakroleinheritance(copyRoleAssignments=true, clearSubscopes=true)

I basically need this block to Remove all inherited permission and specifically remove the "Company Files Member" group. Can this be done on this same HTTP request or will I need 2 HTTP request done? 

Any help would be helpful. 

[jdaniel_dyn365]

I think Chat GPT to the rescue haha This request I was missing the header. Appears it helps to add in the header in the HTTP Block.