Included with SharePoint Essentials Toolkit. See editions and pricing
SharePoint Essentials Toolkit · Permissions
SharePoint Permissions Tool: Report, Audit and Fix Who Has Access
See who can open every SharePoint site, library, folder and file, what permission level they hold, and how they got it: directly, through a group, or through a sharing link. Export the permissions report to Excel for an audit, then fix access straight from the report, with every change recorded and undoable. Works with SharePoint Online and SharePoint on-premises, free on up to 20 sites.
Why SharePoint permissions are hard to audit
SharePoint shows permissions one place at a time. Site permissions shows the site, Manage access shows one file, and Check permissions answers for one person on one site. None of them tells you, across all your sites, who can open what.
- Unique permissions hide below the library. One library can hold hundreds of folders and files with their own permissions. Site-level views don't show them.
- Groups hide people. A grant to "Project Members" or an Entra ID security group says nothing about the 400 people inside it, or the groups nested inside those.
- Sharing links grant access too. Every Anyone, organization or specific-people link adds access that never appears in the site's permission list.
- Microsoft's data access governance reports need SharePoint Advanced Management for the snapshot reports, refresh up to 48 hours late, and mostly report at site level.
A permissions audit tool reads all of it, down to the file, and puts it in one report you can filter, export and act on.
What the permissions tool covers
Permissions report
Every grant on every site, subsite, list, library, folder, file, page and list item you choose, with the principal, permission level, scope, account type and whether permissions are inherited or unique.
Everything one person can access
Check a user's permissions across sites. Pick one or more accounts and see every site, list, folder and file they can open, and the route: direct, SharePoint group, Microsoft 365 group, security group or sharing link.
Groups expanded, including nested
See the people behind each grant: SharePoint group members, Teams and Microsoft 365 group owners and members, and Entra ID (Azure AD) security groups, including groups nested inside groups.
Sharing links in the report
Grants that come from sharing links appear next to ordinary permissions, with the link type, scope and recipients, so the report shows real access, not just the site's permission list.
Who has Full Control
A privileged access inventory: site collection administrators, owners and every account with Full Control or a custom high-privilege level, across all selected sites.
Guests and external users
Everything guests can reach, from site membership to a single shared file. Filter any permissions report to Guests & external only for a SharePoint external users report.
Fix access from the report
Tick rows and the Actions panel explains what will change before you apply it: remove direct permissions, remove group memberships, or reset folders, files and lists to inherit again.
Undo and history
Every permission change is recorded in History with who made it and when. Supported changes can be undone one by one or together, for 30 days by default.
User and access administration
- Replace one user with another, for a role change or a leaver's successor, across every site in scope.
- Copy access from a colleague (clone user permissions) to onboard a new hire with the same access as a teammate.
- Add a person to groups and sites, or remove a person from everything when they leave.
- Clean up orphaned users: accounts that no longer exist in the directory but still hold permissions.
- Add, remove or replace site collection administrators in bulk.
Audit evidence and monitoring
- Export to Excel (standard, values only, or print-friendly), CSV, or a SharePoint list or library. Email the report on completion.
- Permission change monitor: a scheduled report compared run over run, with email alerts when access changes or crosses a threshold you set.
- Compliance reports labeled with the SOC 2, ISO/IEC 27001:2022, NIST SP 800-53 and CMMC 2.0 controls they support, with run evidence (who ran it, when, from where and which sites completed) saved with each run.
- Presets, include and exclude rules, and content filters to report only what an auditor asked for.
How it works
- Connect. Install the Windows app and connect to Microsoft 365 with the built-in Azure app registration wizard, or to SharePoint on-premises.
- Pick sites. Choose sites by hand, search for them, or let discovery find them. Narrow to specific lists if you want.
- Choose a preset. Full permissions report, unique permissions only, external users, Full Control, or one person's access.
- Run and review. Switch between the grouped view and the flat All Permissions view, filter by scope, account type or permission level, and drill in.
- Export or fix. Export the evidence, or select rows and fix access from the Actions panel.
Built-in SharePoint tools compared
| SharePoint built-in | PowerShell (PnP) | SharePoint Essentials Toolkit | |
|---|---|---|---|
| Scope | One site, library or file at a time; data access governance reports at site level | Whatever you script | Many sites at once, down to each file and item |
| Nested groups | No | Extra Microsoft Graph calls | Yes, SharePoint, Microsoft 365 and Entra ID groups, nested |
| Sharing links | Per file, in Manage access | Per file, with a loop | Included in the report |
| Export | CSV from the admin center | CSV | Excel, CSV, SharePoint, email |
| Fix from the report | No | Separate scripts | Yes, with review and undo |
| Licensing | Snapshot reports need SharePoint Advanced Management | Free, plus build time | Free on up to 20 sites |
Editions
| Capability | Community (free) | Professional | Enterprise |
|---|---|---|---|
| Permissions report, one person's access, Full Control, guests and external users | Yes, full depth | Yes | Yes |
| Nested group expansion and sharing link details | Yes | Yes | Yes |
| Export to Excel, CSV and SharePoint, email delivery | Yes | Yes | Yes |
| Fix permissions from reports | Up to 10 changes per Apply | Up to 10 changes per Apply | Unlimited |
| Replace, clone, add or remove users; clean up orphaned users; manage site collection admins | No | No | Yes |
| Sites | 20 per Microsoft 365 tenant | More sites; see pricing and the full comparison | |
Community Edition never expires and has no row, item or user caps within a report. See Community Edition limitations.
Frequently asked questions
How do I get a report of all permissions in SharePoint Online?
SharePoint itself shows permissions one site, library or file at a time. SharePoint Essentials Toolkit runs a permissions report across the sites you choose and lists every grant on every site, list, folder and file, with the permission level and how the person got it: directly, through a group, or through a sharing link. Community Edition runs it free on up to 20 sites.
How do I export SharePoint permissions to Excel?
Run the permissions report, filter or group it the way you want, and export it. SharePoint Essentials Toolkit exports to Excel in three layouts (standard, values only, and black and white for print), to CSV, or to a SharePoint list or library. The export keeps your filters, so you can send a reviewer only the external users or only the unique permissions.
Can I see everything one user has access to in SharePoint?
Yes. The Everything one person can access task checks one or more accounts across the sites you pick and lists every site, list, folder and file they can open, including access through SharePoint groups, Microsoft 365 groups, Entra ID security groups and sharing links.
Does the report expand nested Entra ID (Azure AD) groups?
Yes. The permissions report can expand SharePoint group members, Microsoft Teams and Microsoft 365 group owners and members, and Entra ID security groups, including groups nested inside other groups, so you see the people behind each grant rather than just the group name.
Does running a permissions report change anything in SharePoint?
No. Reports are read-only. Changes only happen when you select rows, open the Actions panel, review the list of changes it shows, and click Apply. Each change is recorded in History and supported permission changes can be undone, for 30 days by default.
Is the SharePoint permissions report free?
Yes, on up to 20 site collections per Microsoft 365 tenant with Community Edition, which never expires. Every read-only permissions report runs at full depth with no row, item or user caps. Fixing permissions in bulk, replacing or cloning users and cleaning up orphaned accounts need Enterprise; Community lets you try report actions with up to 10 changes per Apply.
Guides and related features
Run a full SharePoint permissions report free
SharePoint Essentials Toolkit Community Edition is free and never expires. Report every permission on up to 20 sites per Microsoft 365 tenant, with no row caps and no trial period.
Get your free Community Edition license key Talk to us about Enterprise