Assigning a security group to Sharepoint site

[maxrebo]

I`m setting up a new Sharepoint site and want to add all our staff to it from a O365 security group, can this be done?

I can only add them individually and only seem to find information online as to do it that way.

Might be me being slow but I cant see it!.

 

Cheers

[djm968]

Click settings cog on the site, select >site permissions > Add Members > Share Site Only.

[maxrebo]

Thanks - Last question - Which might require a separate Post..

 

So this is a migration from a onsite File share - What's the best way of controlling access to subfolders in SP? What I've done is in SharePoint > "Documents" created a subfolder for English, Maths etc... but I want to control access to these subfolders only to Maths department etc...

 

I see you can break inheritance but cant find a way to assign a group to the sub folder.

[djm968]

I think you might have to break inheritance before you can grant additional permissions.

[psydii]

I came to the conclusion that generally this is a bad idea. We've gone with one site per group requiring access with a Hub page to allow for those who need some level of spatial navigation across all folders.

 

If you really need to go down that route... this code might help you scripting it. (it sets per user, however I'm sure it would be fairly easy to do per group)

 

# Create per user folder in SharePoint Site
connect-azuread
Connect-SPOService https://TENANTNAME-admin.sharepoint.com



$SiteName = "SITENAME"
$Group = "GROUPNAME"
$SiteAbsoluteURL  =  "https://TENANTNAME.sharepoint.com/sites/" + $SiteName
$SiteRelativeURL = "/sites/" + $SiteName
$listname = "Student Work"
$listnameAsRelativeURL = "/" + $listname
$FolderServerRelativeURL = $SiteRelativeURL + $listnameAsRelativeURL 

Connect-PnPOnline -Url $SiteAbsoluteURL -UseWebLogin



new-pnplist -Title  $listname -Template DocumentLibrary -OnQuickLaunch

$UserList = (Get-AzureADGroup -SearchString $group|Get-AzureADGroupMember)
foreach ($user in  $UserList)
{
   #write-host $user.givenname $user.surname
   $studentFolderName = $user.givenname + " " + $user.surname 
   $targetFolder = $FolderServerRelativeURL + "/" + $studentFolderName
   Write-Host $studentFolderName
   Write-Host  $user.UserPrincipalName
   Add-PnPFolder -name $studentFolderName -Folder $listnameAsRelativeURL
   #write-host "Set-PnPFolderPermission -List"+ $listname +"-Identity " + $targetFolder +"-AddRole edit -User " + $user.UserPrincipalName "-ClearExisting"
   Set-PnPFolderPermission -List $listname -Identity $targetFolder -AddRole edit -User $user.UserPrincipalName -ClearExisting

   
}

 

This is basically what the Teams Assignment tool does when it provisions student folders.

Edited March 10, 2022 by psydii

[Planehazza]

Make sure you use the SharePoint migration tool to move the data, rather than manually uploading multiple files through the browser.

[KK20]

We used sharepoint migration tool to get stuff offsite initially. This gave staff the same-ish layout they had previously. We also used CloudDrive Mapper to map a drive letter. Phase two had the departmental areas created and staff moved their bits and pieces into their own areas that they controlled, had access to etc. Phase three removed the CDM drive share.

 

This meant I wasnt making the decision on what to keep, what to use - staff did that as we went along. The area was self policing as departments had their own areas and set their own permissions. We have blocked universal sharing.

 

Onedrive was similar, I didnt force a onedrive migration, we originally remapped "ununsed" home drive to onedrive. I then set the quota for onsite documents to be "very small". Staff and pupils could get their old stuff but had to re-save into their homedrive/onedrive. Once they deleted their old documents we ended up with a small quota for onsite storage. this is still useful for photograph manipulation, media use etc. However staff naturally started to mail links to documents and not the documents themselves, file version and history is loved by everyone, ease of manipulating the links to onedrive/sharepoint in our VLE was preferred etc.

 

I would say it took 3 years from start to finish for a full and working migrated onsite to offsite.

[Planehazza]

We used sharepoint migration tool to get stuff offsite initially. This gave staff the same-ish layout they had previously. We also used CloudDrive Mapper to map a drive letter. Phase two had the departmental areas created and staff moved their bits and pieces into their own areas that they controlled, had access to etc. Phase three removed the CDM drive share.

 

This meant I wasnt making the decision on what to keep, what to use - staff did that as we went along. The area was self policing as departments had their own areas and set their own permissions. We have blocked universal sharing.

 

Onedrive was similar, I didnt force a onedrive migration, we originally remapped "ununsed" home drive to onedrive. I then set the quota for onsite documents to be "very small". Staff and pupils could get their old stuff but had to re-save into their homedrive/onedrive. Once they deleted their old documents we ended up with a small quota for onsite storage. this is still useful for photograph manipulation, media use etc. However staff naturally started to mail links to documents and not the documents themselves, file version and history is loved by everyone, ease of manipulating the links to onedrive/sharepoint in our VLE was preferred etc.

 

I would say it took 3 years from start to finish for a full and working migrated onsite to offsite.

 

Great read, thanks. Makes me feel better about myself and our adoption. Staff are very reluctant to change here, and I'm doing my best to reassure and train people where possible. We've had things online for a while, but it's still a moving process with some people still trying to use the local T drive. We've not moved away from local H drives yet, but people are naturally moving to OneDrive. I just wish people would not hog resources; a file does not belong to a person, it belongs to that role. IMO, only holiday/TOIL/Appraisal stuff etc should exist in OneDrive; all other stuff should be in a SharePoint site.

 

We back up Cloud stuff too, on a p per GB basis, so everyone is restricted to 100GB instead of the default 1000GB, and we've hard restricted local H drives to 15GB. That, hopefully, will keep reducing until they're all but gone. Realistically, we'll limit it to a downloads folder and I hope that downloading severely drops as we educated people on sharing files and 'open with desktop app' features (don't get me started on the amount of people that "hate being forced to use office on the web" 🤦♂️)

[KK20]

It has evolved for us. Staff have moved away from the mentality of "staff drive/pupil drive" and more to "department area with permissions". We also use teams a lot so the two are meshed somewhat. Reluctance was high, hence the CDM as a halfway house. However once staff started to use the links, versions, hybrid working people shifted behaviour. I ran quite a few sessions on benefits of working with cloud documents, how to sync files and folders with the online equivalents, how to share working documents with other people plus classroom collaboration etc. It took time but we got there in the end.

[Planehazza]

It has evolved for us. Staff have moved away from the mentality of "staff drive/pupil drive" and more to "department area with permissions". We also use teams a lot so the two are meshed somewhat. Reluctance was high, hence the CDM as a halfway house. However once staff started to use the links, versions, hybrid working people shifted behaviour. I ran quite a few sessions on benefits of working with cloud documents, how to sync files and folders with the online equivalents, how to share working documents with other people plus classroom collaboration etc. It took time but we got there in the end.

Please can you share how you managed to get teachers to engage? Our emails aren't read, Tech tips teams messages aren't read. IT helpdesk FAQs aren't read. We can't get the school to understand the importance and value of training sessions they've already paid for. I've tried hosting tech tip sessions, a casual open event where staff drop in and can learn how to use features in Teams, SharePoint, Office, Forms etc - not one staff member showed up. It's so frustrating.