in

Dot Net Mafia

Group site for developer blogs dealing with (usually) .NET, SharePoint, Office 365, Mobile Development, and other Microsoft products, as well as some discussion of general programming related concepts.

This Blog

Syndication

Archives

Corey Roth [MVP]

A SharePoint MVP bringing you the latest time saving tips for SharePoint 2013, Office 365 / SharePoint Online and Visual Studio 2013.

May 2014 - Posts

  • How to: Use PowerShell to Create and Manage Users and Groups in SharePoint Online

    I have an upcoming talk at TechEd 2014 and part of it will be spent showing you how you can manage users with PowerShell in SharePoint Online.  I thought, I would give a little preview and show you some of the ways you can manage users.  If you are using Office 365, this post will get you started, creating, deleting, and adding users to groups.   You'll also learn how to set permissions on groups as well as promote site collection administrators.  You'll need to install SharePoint Online Management Shell, if you haven't already. 

    Get started by opening a session using Connect-SPOService and the full URL to the admin site of your tenant.  You can see my first SharePoint Online PowerShell post for the syntax.

    You'll need to know the URL to the site collection you are working with for all of these commands. 

    Getting a list of users

    We can start by getting a simple list of all users on a site using Get-SPOUser.

    Get-SPOUser -Site https://mytenant.sharepoint.com/sites/mysitecollection

    SPOPOwerShellGetSPOUser

    This will give you a list of all users, the login name, and what groups each user belongs to.  If you look all the way down the list, you'll even notice some internal hidden users such as the cache, crawl, and system accounts.

    SPOPOwerShellGetSPOUser2

    Even with a small list, you'll notice that this cmdlet takes a while to execute.  You can filter it by specifying a specific user or group.  For example, to retrieve the user information for our user, Sara Davis, we use the same cmdlet with the -LoginName parameter.  Keep in mind you have to specify the full login name.

    Get-SPOUser -Site https://mytenant.sharepoint.com/sites/mysitecollection -LoginName user@mytenant.onmicrosoft.com

    SPOPOwerShellGetSPOUserLoginName

    To view all of the users in a group, use the -Group parameter.

    Get-SPOUser -Site https://mytenant.sharepoint.com/sites/mysitecollection - Group "My Group"

    SPOPOwerShellGetSPOUserGroup

    You'll notice there are not any commands to add new users.  Those are handles at the Office 365 level.  If the user requires a brand new account, you create the user there and then add them to the appropriate groups.

    Getting a list of groups

    We can retrieve a list of groups on a given site using Get-SPOSiteGroup.

    Get-SPOSiteGroup -SiteName https://mytenant.sharepoint.com/sites/mysitecollection

    SPOPowerShelGetSPOSiteGroup

    This will show you the name of the group, the roles of the group, and what users are in it.  You may want to use FormatTable to make the results easier to read.

    Get-SPOSiteGroup -SiteName https://mytenant.sharepoint.com/sites/mysitecollection | FT Title, Roles -AutoSize

    SPOPowerShelGetSPOSiteGroupFormatTable

    You can also request a specific group by name, with the -Group parameter

    Get-SPOSiteGroup -SiteName https://mytenant.sharepoint.com/sites/mysitecollection -Group "My Group"

    SPOPowerShellGetSPOSiteGroupByName

    Creating a group

    To create a Group, we use the New-SPOSiteGroup cmdlet.  You will need to pass the name of the group using the -Group parameter as well as the site collection.  In the -PermissionLevels attribute, you pass the name of a known permission level such as Contribute, Design, or Full Control.

    New-SPOSiteGroup -Site https://mytenant.sharepoint.com/sites/mysitecollection -Group "Group Name" -PermissionLevels "Contribute"

    SPOPowerShellNewSPOSiteGroup

    This cmdlet tends to take a while.  Once it's done, it will return information about your group.  If you assign the return value of this cmdlet to a variable, you can then pass it to Add-SPOUser to add a user to the group.

    Adding a user to a group

    Once you create a group, you will probably want to add a user to it.  We can do that with Add-SPOUser.

    Add-SPOUser -Site https://mytenant.sharepoint.com/sites/mysitecollection -Group "Group Name" -LoginName user@mytenant.onmicrosoft.com

    SPOPowerShellAddSPOUser

    Using Get-SPOUser, like we showed earlier, we can verify our new users is in the group.

    SPOPowerShellGetSPOUserGroup2

    Removing a user from a group

    As you might guess, removing a user from a group takes the same three parameters with the Remove-SPOUser cmdlet.  However, the Group is optional.  Include it to remove the user from a specific group or omit it to remove the user from the site entirely.

    Remove-SPOUser -Site https://mytenant.sharepoint.com/sites/mysitecollection -Group "Group Name" -LoginName user@mytenant.onmicrosoft.com

    SPOPowerShellRemoveSPOUserGroup

    When successful, no output will be returned.

    Adding a permission level to a group

    To change permissions on a group, we use the Set-SPOSiteGroup  To add a permission level to a group, use the -PermissionLevelsToAdd parameter.  Note this cmdlet uses the -Identity parameter instead of -Group.

    Set-SPOSiteGroup SPOUser -Site https://mytenant.sharepoint.com/sites/mysitecollection -Identity "Group Name" -PermissionLevelsToAdd "Design"

    SPOPowerShellSetSPOSiteGroupAddPermissions

    Removing a permission level from a group

    We can also use Set-SPOSiteGroup to remove a permission level as well using the -PermissionLevelsToRemove parameter.

    Set-SPOSiteGroup SPOUser -Site https://mytenant.sharepoint.com/sites/mysitecollection -Identity "Group Name" -PermissionLevelsToRemove "Contribute"

    SPOPowerShellSetSPOSiteGroupRemovePermissions

    You can also use Set-SPOSiteGroup to rename it with the -Name parameter as well as change the owner with the -Owner parameter.

    Removing a group

    To remove the group, use the Remove-SPOSiteGroup.  For some reason, this cmdlet uses the -Identity parameter instead of -Group so pass the name there.

    Remove-SPOSiteGroup SPOUser -Site https://mytenant.sharepoint.com/sites/mysitecollection -Identity "Group Name"

    SPOPowerShellRemoveSPOSiteGroup

    Make a user a site collection administrator

    We can give users site collection administrator rights, but the functionality is buried in Set-SPOUser.  Set the -IsSiteCollectionAdmin command to $true to make the user a site collection administrator.

    Set-SPOUser -Site https://mytenant.sharepoint.com/sites/mysitecollection -Group "Group Name" -LoginName user@mytenant.onmicrosoft.com -IsSiteCollectionAdmin $true

    SPOPowerShellSetSPOUser

    To remove site collection administrator rights, simple set IsSiteCollectionAdmin to $false.

    Get a list of site collection administrators

    If you want to see who all of the site collection administrators are, you can find the value on the IsSiteAdmin property of the user object returned from Get-SPOUser.  You just have to display it.  In the example below, we select the column using Format-Table (ft).

    SPOPowerShellGetSPOUsersSiteCollectionAdmin

    We'll be covering this and a lot more at my PowerShell talk at TechEd next week.  If you are there, be sure and attend.

2015 dotnetmafia.
Powered by Community Server (Non-Commercial Edition), by Telligent Systems