Migrating Permissions across SharePoint sites using ShareGate

In SharePoint, permissions are crucial for ensuring appropriate access to resources within SharePoint sites. There may be instances where you need to replicate the permissions of one site to another. To achieve this, a method for copying or migrating SharePoint site permissions from one site to another is necessary.

In this article, we will provide a step-by-step guide on how to copy or migrate SharePoint site permissions from one site to another.

For Migrating the Permission we will be using the ShareGate Migration Tool, Its a migration tool that simplifies and accelerates migration processes directly to the latest SharePoint or Microsoft 365.

Prerequisites:

• ShareGate licence

• ShareGate Migration Tool Installed

• The user performing this action must be a Site Collection Administrator

• PowerShell version 3.0 or higher (Note: This will not work with version 7.0)

Migrating permissions across sites involves not only assigning users to their respective groups but also migrating the Permission Roles, SharePoint Groups, and their associated Users.

We will be migrating the Permissions using two methods.

Method 1 Using ShareGate Migration tool:

The ShareGate migration tool offers user-friendly features that simplify any migration task. When migrating permissions, you can select the source site and destination site, ensure proper mapping, and migrate the permissions with just a click. Follow the steps below to migrate permissions using the migration tool.

Step 1: Open the ShareGate Migration Tool. In the left section, click on "Copy" and then select "Copy Structure and Content."

Step 2: Enter the source site URL, select "Browser for Authentication," and log in with your credentials.

Step 3: Similarly, log in to the destination site by entering the destination URL and selecting "Browser" as the authentication type. Once logged in to both the source and destination sites, you will see the following interface.

Step 4: First, migrate the Permission Levels, and then migrate the SharePoint Groups from the source site to the destination site.

Select the Permission Levels, choose the specific Permission Levels you want to migrate, and then click "Start Copy."

With this, the permission roles will be copied to the destination site. Next, we can proceed to migrate the SharePoint Groups across the sites.

Open the SharePoint Groups from the Site Objects.

Step 5: Now, select all the groups that you want to migrate to the destination site.

Make sure that Mapping is set for the default Groups of SharePoint like Members, Owners and Visitors under mappings as shown below.

ShareGate Mapping provides a way to map the source object with destination and set the content accordingly in the destination as per the mapping.

Now, click "Start Copy" to begin copying the SharePoint groups along with their members.

After the copying task is completed, you will see that the groups have been migrated. You can also verify the members of each group by checking the respective site.

Method 2: Using ShareGate & PnP PowerShell

PowerShell is a robust command-line tool that can automate numerous tasks in Microsoft 365. For copying SharePoint site permissions from one site to another, we will use ShareGate PowerShell. Execute the following PowerShell script to copy the SharePoint site permissions.

Note: Please ensure that you have the Sharegate module imported before running this script. Additionally, ensure that PnP.PowerShell version 1.12 is installed (ShareGate Migration tool must be installed on your system).

To import the Sharegate module, use the following command:

Import-Module Sharegate

To install PnP.PowerShell version 1.12, use:

Install-Module PnP.PowerShell -RequiredVersion 1.12 -Force

• Execute the script provided below.

• Enter your login credentials when prompted to access the site.

• The script will then continue its execution.

#Config Parameters
$SourceSite = "<<Source Site>>"
$DestinationSite = "<<Destination Site>>"


#Function to Copy-Migrate the SharePoint Site Level Permission from one site to another
Function Copy-MigrateSiteLevelPermission {
    param (
        $DestinationSite,
        $SourceSite
    )
   
    Write-Host "Establishing the connection between source site and destination site..."
    $Source = Connect-Site -Url $SourceSite -Browser
    $Destination = Connect-Site -Url $DestinationSite -UseCredentialsFrom $Source
   
    Write-Host "Setting up the Mappings for the Default SharePoint Groups..."
    $mappingSettings = New-MappingSettings
    $mappingSettings = Set-UserAndGroupMapping -Source "Destination Site Members" -Destination "Source Members"
    $mappingSettings = Set-UserAndGroupMapping -MappingSettings $mappingSettings -Source "Destination Site  Owners" -Destination "Source Owners"
    $mappingSettings = Set-UserAndGroupMapping -MappingSettings $mappingSettings -Source "Destination Site  Visitors" -Destination "Source Visitors"

    Write-Host "Copying the Permission from one site to another..."
    Copy-ObjectPermissions -Source $Source -Destination $Destination -MappingSettings $mappingSettings
    Write-Host "Permission Copied Successfully from one site to another..." -f Green
}


#Function to Copy the Permission Level from one site to another
Function Copy-PermissionLevel {
    param (
        $DestinationSite,
        $SourceSite
    )
    Write-Host "Connecting with Source and Destination Site..."
   
    $SourceSiteConnection = Connect-PnPOnline -Url $SourceSite -UseWebLogin -ReturnConnection
    $DestinationSiteConnection = Connect-PnPOnline -Url $DestinationSite -UseWebLogin -ReturnConnection


    Write-Message "Starting the Migration Process for Permission Levels..."
    Write-Message "Reading all the Permission Level From source site..."
    $AllPermissionLevel = Get-PnPRoleDefinition -Connection $SourceSiteConnection


    foreach ($permissionLevel in $AllPermissionLevel) {


        $permissionLevelName = $permissionLevel.Name
        Write-Host "Migration: $permissionLevelName"
        Write-Host "Checking permission level $permissionLevelName..."
       
        if (!(Get-PnPRoleDefinition -Identity $permissionLevelName -ErrorAction SilentlyContinue -Connection $DestinationSiteConnection)) {
            Write-Host "Creating new permission level $permissionLevelName..."
       
            if ($permissionLevel.PermissionLevels) {
                Add-PnPRoleDefinition -RoleName $permissionLevelName -PermissionLevels $permissionLevel.PermissionLevels -Description $permissionLevel.Description -Connection $DestinationSiteConnection
            }
            else {
                Add-PnPRoleDefinition -RoleName $permissionLevelName -Clone $permissionLevel -Description $permissionLevel.Description -Connection $DestinationSiteConnection
            }
        }
    }
    Write-SuccessMessage "Permission Level Migration Completed successfully..."
}

#Execute the Function to Copy the Permission Level
Copy-PermissionLevel -DestinationSite $DestinationSite -SourceSite $SourceSite

#Execute the Function with Parameter to Copy the Groups and other Permissions
Copy-MigrateSiteLevelPermission -DestinationSite $DestinationSite -SourceSite $SourceSite

Upon successful execution of the script, you will observe that permission roles within SharePoint Groups have been copied from one site to another. This demonstrates how ShareGate PowerShell and the ShareGate Migration tool facilitate the migration of SharePoint site permissions between sites.

If you have any questions you can reach out our SharePoint Consulting team here.

How to set Item level permission in SharePoint List/Library using Power Automate

Introduction:

In this blog, we can learn how we can set item level permission on a List Item or a Document when new item or document is created or modified in SharePoint List/Library. Using Power Automate (MS Flow), we can achieve this by breaking inheritance and assign specific permission to SharePoint User/Group.

Here are detailed steps to be followed in your SharePoint Online tenant to meet the requirement.

Step 1:  Create new flow from blank template. Add a trigger “When a file is created or modified in a folder” and entered your Site address URL (http://yourtenant.sharepoint.com) and List/library URL(/SitePages) for which you need to set unique permission.

 

Step 2: Add an action “Get file metadata” and configure with the values as shown in below screenshot.

 

Step 3: Add next action “Get file properties” and configure with the values as shown in below screenshot.

Step 4: Add an action “Initialize Variable”, Name it as “AuthorPrincipal” as shown in the below screenshot. This will be used to store Author User Principal id.

 

Step 5: Add one more action called “Initialize Variable”, rename it as  “GroupID” as shown in the below screenshot. This will be used to store Principal Id of SharePoint Group.

 

Step 6: Then we need to add an action called “Send an HTTP request to SharePoint” to break permission on an item and need to pass parameters as shown in the below screenshot.

 

Step 7: Now, to assign specific permission to a user on that item, first we need to get the Principal Id of the user (here, Modified By user). For that, add another action “Send an HTTP request to SharePoint” and configure all fields as shown in the below screenshot.

 

Step 8: Now, store that Principal Id  of that user in a variable. To do that, add action “Set Variable” and set the value with => Body(‘Send_an_HTTP_request_to_Sharepoint_2’)[‘d’][‘id]

 

Step 9: Now to assign permission to item/document, add an action “Send an HTTP request to SharePoint” and configure fields as shown in the below screenshot. Here, we are assigning Contribute permission to Last Modified By User.

 

To assign permission to a SharePoint group, you can follow steps 10, 11 & 12 instead of 7,8 & 9 and setup flow accordingly.

Step 10: First, to get the Principal Id of SharePoint group, add an action “Send an HTTP Request to SharePoint” with values as shown below screenshot.

• Set Uri as “/_api/Web/SiteGroups/GetByName(‘Your-group-name’)  

Note: “Content-Approval” is custom SharePoint group.

 

Step 11: Now, to store Principal Id in a variable, add an action “Set Variable” and rename it as “Set-GroupID” and configure with value => Body(‘Send_an_HTTP_request_to_Sharepoint_5’)[‘d’][‘id’]

 

Step 12: Now, to assign permission to that SharePoint group, we need to add an action “Send an http request to SharePoint”, and configure its value as shown in the below screenshot.

 

Important Notes:

1. Below is table listing different Role Definition Name and Id that can be used in MS Flow as per requirement.

Role Definition Name	Role Definition Id
Full Control	1073741829
Design	1073741828
Edit	1073741830
Contribute	1073741827
Read	1073741826
View Only	1073741924

2. Also, we can reset the permission and assign Parent level permission on the item by adding action "Send an HTTP request to SharePoint" with values as shown in below screenshot.

 

 If you have any questions you can reach out our SharePoint Consulting team here.

Users with Full Control permission are not able to create sub-site in SharePoint

Problem Statement:

I spent lot of time to fix a strange issue while working with SharePoint 2013 project. Issue was a user having Full Control permission in SharePoint Top level site was not able to create a sub-site. Each time user tried to create either a "Project Site" or "Team Site" user got “Sorry, you don’t have access to this page” or “Access Denied” error. This was the identical behavior for all the users having Full Control permission.

Problem Symptoms:

      1. It appeared SharePoint was ignoring the Full Control access permission.

      2. User with site collection administrator permissions could create sub-sites.

      3. New site collections on the same web application operated normally without this issue.

Root Cause:

     1. Internally, SharePoint manages a hidden list named "TaxonomyHiddenList". URL of the list is -  "[sitecollectionURL]/lists/taxonomyhiddenlist".

     2. Generally, All authenticated users (everyone) has Read access to this list.

     3. As a site collection administrator user, when I checked permissions of the list, I found none of user or group were having permissions to this list as you can see in below screenshot.

Resolution: The solution was simple once identified. We should assign read access to all authenticated users (Everyone) operating within the site collection.

I had spent more time to fix the issue as it was a difficult one to identify, Hope this helps you out to overcome it more efficiently.

If you have any questions you can reach out our SharePoint Consulting team here.