PowerShell to remove SharePoint subsite permission levels alone

Thank you Naimish and Jignesh for your quick response.

Hi Naimish, Need to add site URL, group name in the script you have shared. But we have over 500 sites which are from different site collections and we are not sure on how many groups those subsites and the permission levels too. We do not want to remove groups or users from the sites.

Hi Jignesh, Does your script will impact only the subsite that is dealing with or will it impact the sub-subsites also under the parent subsite. how to ignore sub-subsites, if it impacts all the sub-subsites under a parent susite?

Hello Madhu,

Try below script.

# Set the subsite URL and the group/user name whose permissions need to be removed
$subsiteUrl = "http:///"
$groupName = "Group Name or User Name"

# Get the subsite object
$web = Get-SPWeb $subsiteUrl

# Get the group/user object
$group = $web.SiteGroups[$groupName]

# Remove the group/user permissions from the subsite
$web.RoleAssignments.Remove($group)

# Dispose the objects
$group.Dispose()
$web.Dispose()

# Remove group/user permissions from subsites in other site collections
$siteCollections = @(
    "http://",
    "http://",
    "http://"
)

foreach ($siteCollectionUrl in $siteCollections) {
    # Get the site collection object
    $site = Get-SPSite $siteCollectionUrl

    # Get the web application object
    $webApp = $site.WebApplication

    # Loop through all the subsites and remove the group/user permissions
    foreach ($web in $webApp.Sites | Select -ExpandProperty AllWebs) {
        if ($web.Url -ne $subsiteUrl) {
            # Check if the group/user has direct permissions in the subsite
            $roleAssignment = $web.RoleAssignments.GetAssignmentByPrincipal($group)
            if ($roleAssignment -ne $null) {
                # Remove the group/user permissions from the subsite
                $web.RoleAssignments.Remove($group)
            }
        }
        
        # Dispose the subsite object
        $web.Dispose()
    }

    # Dispose the objects
    $webApp.Dispose()
    $site.Dispose()
}

Thaks

Naimish Makwana

Hello,

Can you please try below,

Connect-PnPOnline -Url "https://your-site-url.sharepoint.com/sites/your-site"

# Get the subsite
$subsite = Get-PnPWeb -Identity "Subsite URL"

# Get all the permission levels of the subsite
$permissions = Get-PnPProperty -ClientObject $subsite -Property RoleAssignments.Include(RoleDefinitionBindings)

# Remove the permission levels
foreach ($permission in $permissions) {
    Remove-PnPRoleAssignment -Identity $permission.Id
}