SharePoint Online Permissions Reporting: Who Can Access What?

Last updated: 2026-10-15

Find site, list, folder and file access; check one user; identify unique permissions; and export a reviewable spreadsheet. This guide applies to SharePoint Essentials Toolkit.

Cognillo · By David Cooper

Find site, list, folder and file access; check one user; identify unique permissions; and export a reviewable spreadsheet. This guide applies to SharePoint Essentials Toolkit.

How do I get a report of who has access to what in SharePoint Online?

Run a Permissions Report in SharePoint Essentials Toolkit against the sites and libraries you need to review. The report provides user- and group-centric views and a permissions tree. Configure directory-group expansion and sharing-link details before scanning, then check the selected scope and completed job status before treating the output as an access inventory.

  1. Connect to SharePoint with an account authorized to read the selected content. Use the Azure app-registration guide for directory information.

  2. Select the sites and, if needed, particular lists or libraries. Start a Permissions Report from the Tasks page or the available site report action.

  3. Review scope and report options. Include group membership and sharing-link details where your connection supports them.

  4. Run the report, inspect completion and errors in Job History, then review the permissions matrix and tree.

How can I see everything one user can access?

Use the Everything One Person Can Access check across the selected SharePoint sites. Review direct grants, group memberships, administrator roles, site ownership and sharing links together. A result is only as complete as the scan scope and the account’s access; directory-group expansion requires the appropriate app configuration and permissions, including when nested groups are involved.

  1. Choose the user and the sites included in the review.

  2. Include SharePoint and directory group members where authorized; verify the required app consent.

  3. Review each access route, including inherited access from a parent. Export the result and record sites that were not scanned.

How do I find items with unique permissions?

Use the Unique permissions preset in a Permissions Report to locate content that no longer follows its parent’s access. Review files, folders and list items alongside their parent library or list. Unique permissions are a review signal, not proof of a problem: legitimate exceptions need owner approval before inheritance is restored or people are removed.

  1. Select the Unique permissions preset and scan the required sites or libraries.

  2. Compare each exception with its parent and intended business access.

  3. Export the exceptions for owner review before applying permission changes.

How do I export SharePoint permissions to Excel?

After a Permissions Report completes, choose the report export to Excel or CSV and retain the scope and run date with the file. SharePoint Essentials Toolkit supports Simple and Data-aware Excel formats. Community Edition includes exports and has no report row, item or user caps within its site allowance; spreadsheet software can still impose its own limits.

  1. Finish the scan and resolve or document failed portions.

  2. Choose columns and filters for the review, then export to Excel or CSV.

  3. Keep an unfiltered baseline separately from the filtered review copy. Protect both files because they describe access.

How do I report file- and folder-level permissions?

Include the relevant document libraries and item-level permissions in the scan, then review the permissions tree and unique-permission entries. The existing permissions guide explains that inherited files and folders may be represented through their parent rather than repeated as individual rows. Follow the parent’s access route before assuming an inherited item is absent from the access review.

  1. Select the libraries containing the files and folders.

  2. Review unique item entries and their parent permissions.

  3. Use the user-centric view to check a particular person, and document any unscanned content.

How long does a permissions scan of 50,000 items take?

Cognillo estimates that a permissions scan of 50,000 items averages about 7–10 minutes. More uniquely permissioned items and larger memberships per item can increase that time. This is a product-team estimate, not a guaranteed duration or a published controlled benchmark. Measure a representative library in your own environment before setting a scheduled reporting window.

  1. Record the build, connection configuration, item count and unique-permission count.

  2. Time a representative scan and record errors or retries.

  3. Allow a larger window for sites with many permission exceptions or large memberships.

Sources and next steps

Start with the Community Edition reporting limits and SharePoint Essentials Toolkit.