SharePoint O365 Get All Users With Certain Role

Question

Is there a way to get all users who have "Full Control" permission at a site collection and subsite level and change their role to something else? PowerShell would be ideal but CSOM would be fine too if that's the only way to do it. I know I can get groups by role but I need a way to get explicitly added users.

I tried this older StackOverflow question: Get all the users based on a specific permission using CSOM in SharePoint 2013 but I keep getting a 403 forbidden error on the first ctx.ExecuteQuery(); for all sites even though I am a collection administrator. I also wonder if anyone had a PowerShell way to do it.

Answer 1

You need the SharePoint Online Management shell to stand up a connection to O365 via Powershell.

Introduction to the SharePoint Online management shell

Answer 2

According the error message, I suspect that the credential is missing in your code.

Please try the code below and let me know whether it works on your side.

    static void Main(string[] args)
    {
        var webUrl = "[your_site_url]";

        var userEmailAddress = "[your_email_address]";

        using (var context = new ClientContext(webUrl))
        {
            Console.WriteLine("input your password and click enter");

            context.Credentials = new SharePointOnlineCredentials(userEmailAddress, GetPasswordFromConsoleInput());
            context.Load(context.Web, w => w.Title);
            context.ExecuteQuery();

            Console.WriteLine("Your site title is: " + context.Web.Title);

            //Retrieve site users             
            var users = context.LoadQuery(context.Web.SiteUsers);

            context.ExecuteQuery();

            foreach(var user in users)
            {
                Console.WriteLine(user.Email);
            }
        }
    }

    private static SecureString GetPasswordFromConsoleInput()
    {
        ConsoleKeyInfo info;

        SecureString securePassword = new SecureString();
        do
        {
            info = Console.ReadKey(true);
            if (info.Key != ConsoleKey.Enter)
            {
                securePassword.AppendChar(info.KeyChar);
            }
        }
        while (info.Key != ConsoleKey.Enter);

        return securePassword;
    }
}