Streamlining OneDrive File Permissions Management with PowerShell

Efficiently managing file permissions in OneDrive is essential for ensuring that sensitive information is protected while still maintaining collaboration among team members. This PowerShell script allows administrators to automate the process of checking and updating file permissions for a specified folder in OneDrive, enabling you to control access easily and effectively.
This script will:
1. Connect to the OneDrive service using the Microsoft Graph API.
2. Retrieve current permissions for a specified folder.
3. Update permissions to grant or revoke access for designated users.
Utilizing this script can save time and reduce the risk of errors in permission management.

# Install the required module if not already installed
if (-Not (Get-Module -ListAvailable -Name Microsoft.Graph)) {
    Install-Module Microsoft.Graph -Scope CurrentUser -AllowClobber
}
# Connect to Microsoft Graph
Connect-MgGraph -Scopes 'Files.ReadWrite.All', 'Sites.ReadWrite.All'
# Specify the folder and user details
$folderId = "your-folder-id"
$userEmail = "[email protected]"
$permissionType = "write" # Options: write, read
# Get the current permissions for the folder
$permissions = Get-MgDriveItemPermission -DriveId "your-drive-id" -ItemId $folderId
# Output current permissions
Write-Host "Current permissions for folder ID: $folderId"
$permissions | ForEach-Object { Write-Host "$($_.grantedToUser.displayName): $($_.role)" }
# Update permissions for the specified user
if ($permissionType -eq "write") {
    New-MgDriveItemPermission -DriveId "your-drive-id" -ItemId $folderId -Body @{
        roles = @("write")
        grantedTo = @{
            user@{ email = $userEmail }
        }
    }
    Write-Host "Granted write access to $userEmail."
} elseif ($permissionType -eq "read") {
    New-MgDriveItemPermission -DriveId "your-drive-id" -ItemId $folderId -Body @{
        roles = @("read")
        grantedTo = @{
            user@{ email = $userEmail }
        }
    }
    Write-Host "Granted read access to $userEmail."
} else {
    Write-Host "Invalid permission type specified."
}
Disconnect-MgGraph