If you use contentPath or dirPath , the directory you specify in the source argument will be created on the destination computer if it does not already exist. If you select the contentPath provider, you can use its includeAcls=true parameter to copy acls. Here is an example syntax:
msdeploy -verb:sync -source:contentPath=c:\inetpub\wwwroot,includeAcls=true -dest:contentPath=c:\inetpub\wwwroot,computerName=Server1
In order for the permissions to be set correctly, you must use domain accounts or have local accounts with the appropriate security identifiers on both the source and destination computers. See the contentPath article for more information.
If you want to set permissions for the target folder separately, you can use setAcl . setAcl has settings such as setAclUser and setAclAccess that allow for more granular control. See Article for more details, including permissions.