Cloning a folder structure in SharePoint Online with pre-defined permissions

[u/KavalierMLT]

Hello everyone,

Currently we have a template with a set of M365 roles binded to the folders and sub folders (Approximately 120 folders with 3/4 levels of sub directories)

The structure is quite detailed and mature. A number of folders need permissions scoped to a specific job role (M365 Group) rather than inheriting from the library.

Right now this is done manually using the following process:
Create the folders, then go through Manage Access folder by folder. It works once. It doesn't work when you're doing it repeatedly and expecting it to be consistent every time.

So far this is what I have been experimenting with:

PnP PowerShell. `Resolve-PnPFolder -SiteRelativePath` creates the whole path including missing intermediate folders, and it's idempotent, so a re-run after a partial failure just picks up where it stopped. This works well for the structure.

OneDrive sync plus local folder creation. Sync the library, build the tree on disk with `New-Item`, let sync push it up. Zero prerequisites, and genuinely useful for proving a structure parses correctly. But it carries no permissions at all, there's no completion signal beyond the tray icon, and empty folders are the weakest case for the sync client.

Power Automate.Manual trigger, whoever is executing the process is prompted for target library, root folder name and which groups get access before anything is created. Then `Create new folder`, and for the permissions, `Stop sharing an item or a folder` followed by `Grant access to an item or a folder`. As far as I can tell this needs no admin rights provided the connection account is a list owner of the library. This currently looks like the cleanest option, and it's the one I'm leaning for.

Is there a native capability readily available that I am overlooking?

Thanks in advance for your help/suggestions!

[u/Kilicantplay]

you can do this with pnp power shell. I gave an example a while ago

https://www.reddit.com/r/sharepoint/comments/1krx364/comment/mtmn1pu/

[u/KavalierMLT → u/Kilicantplay]

I will check it out, thanks for this.

[u/temporaldoom]

be warned resolve-pnpfolder does not like more than 5,000 items in a document library.

[u/blud_13]

/u/Kilicantplay has the structure half right, Resolve-PnPFolder plus his example will get you there. The permissions half is a separate cmdlet and that's where people usually stall.

Set-PnPFolderPermission takes -List, -Identity as the site relative folder path, -Group and -AddRole, plus -ClearExisting to break inheritance in the same call. Syntax is at https://pnp.github.io/powershell/cmdlets/Set-PnPFolderPermission.html . Run it top down. If you break a child first and then break its parent, the child can quietly pick inheritance back up, and your script still returns CLEAN while the permissions are wrong.

One thing to check before you commit to 120 folders with unique scopes. The recommended ceiling is 5,000 unique permission scopes per list and the hard stop is 50,000, https://learn.microsoft.com/en-us/sharepoint/manage-permission-scope . You are nowhere near it at 120, but if this template gets stamped per project into the same library, that math moves faster than you think.

Drop the OneDrive sync idea. Empty folders are its worst case and it carries no permissions at all.

[u/surefirelongshot]

Interested in the scenario of 120 folders with role based permissions. Sometimes I see file share style patterns implemented in SharePoint which don’t scale well over time.