How to Find Unique Permissions in SharePoint Online

Quick answer

Open any page of the site, open SPO Scout, and run the Permissions Report. In one result it lists the libraries, lists, folders and files in the site with unique permissions, and who has access to each, with their permission levels. The free plan covers the whole site, down to item level; with Pro, SharePoint groups expand to the people inside them, and the report exports to PDF or CSV.

SharePoint itself can show you the exceptions one library at a time, without the people attached.

What unique permissions are, and why they pile up

By default everything in a site inherits its permissions: libraries from the site, folders from their library, files from their folder. A unique permission is an item where that chain has been broken. It keeps its own copy of the permissions, and changes made higher up no longer reach it.

Two things create them: an administrator chooses Stop Inheriting Permissions, or someone shares a file or folder, which breaks its inheritance automatically. The second is the one that surprises people: nobody decides to fragment the permission model; it happens one Share click at a time.

That makes them hard to audit:

• Access can differ at every level. Someone excluded from the site can still open one folder that was shared with them.
• Old shares still count, even after the person who shared has left.
• Fixing the parent doesn't fix the exceptions. Remove a group's permission at site level and every item with unique permissions keeps the old assignment.

Unique permissions aren't automatically a problem: a confidential folder in an open library is a good reason for one. The job is to find every exception and decide whether each is still intentional.

Find unique permissions with SPO Scout

1. Open any page on the SharePoint site.
2. Open the SPO Scout side panel.
3. Run Permissions Report, or Permissions Report (Expanded) to resolve SharePoint groups to their members (Pro).
4. Read the Broken Inheritance count in the summary, then open Unique Permissions to see each exception with the users, groups and permission levels on it.

With Pro, Export PDF opens the full report in its own tab, where you can filter by item name, person or permission level, show or hide inherited objects, and print it.

In the expanded report, a row reads Finance Members: Priya Shah, Jordan Lee, Morgan Davis: Edit rather than just the group name. During an access review, "who is in that group?" is usually the next question, and here it's already answered.

It runs in your existing SharePoint session. There's no app registration, no admin consent, and it reads only what your own account can read.

What to look for in the results

Direct user grants. A person named on an item, rather than a group, is the classic sign of an ad-hoc fix. It's invisible to group-based reviews and survives every change to the groups.

Guests. Someone from outside the organization holding access the surrounding library doesn't grant. The report shows guests by display name without marking them as guests, so check names you don't recognize.

Full Control where Edit would do. Exceptions are usually created in a hurry, and over-permissioning comes with it.

Exceptions nobody can explain. If no one on the team knows why an item stopped inheriting, that's the strongest argument for restoring it.

Sharing links. Links aren't part of the permission report. SPO Scout's sharing link scan (Pro) checks a library and lists the items that carry links and the type of each.

Fix them in bulk (Pro)

Reset Permissions scans a library for items with unique permissions and resets them all back to inheriting, in one step, after a confirmation that shows how many items it will change.

Know what the parent grants first. Restoring inheritance on a restricted folder inside an open library doesn't tighten access, it widens it to everyone the library grants. Export the report before a reset (Pro), so you have a record of what each item held.

Without SPO Scout: what it takes

• One permissions page per library. Each library's page says whether it inherits and, with "Show these items", lists its exceptions, but names the items, not who can open them.
• One visit per exception. Seeing who holds access to each item means opening its sharing settings in turn, and each group's members are on another page again.
• A sharing CSV, for site admins only. Site usage can export a site's sharing report, but it lists SharePoint groups by name, leaves out Anyone links, and is saved to the site as a CSV, with an email when it's ready, rather than shown beside the site.
• PowerShell can walk a site, with its own Entra ID app registration, an administrator's consent, and a script to write and maintain.

Checking one folder takes a few clicks. Checking four thousand is a different exercise, and that's the one SPO Scout turns into a single report.

What SPO Scout covers

• The whole site, down to every folder and file with unique permissions, in its document libraries and custom lists. Other list types, such as Site Pages, picture libraries, calendars and task lists, aren't included. It doesn't read the site's own permission list or cover subsites.
• SharePoint groups expand one level (Pro). On a site connected to a Microsoft 365 group, which includes every team in Teams, that group shows as one entry, with its members managed in Teams or the admin center.
• Free: the permissions report, up to 3 analyses a day. Pro: group expansion, export, sharing link tools and bulk reset.

A practical audit routine

1. One site at a time. Estate-wide in one pass is how audits stall.
2. Run the report and note the broken inheritance count.
3. Expand the groups (Pro). A group name isn't an answer; its membership is.
4. Triage each exception: intentional, stale or unknown.
5. Fix the stale ones: restore inheritance or remove the specific grant.
6. Keep the evidence. Export the before and after (Pro).
7. Repeat quarterly. Sharing doesn't stop.

For the wider process, see the SharePoint permissions audit checklist, and for the report itself, how to generate a SharePoint permissions report.

Frequently asked questions

What is the fastest way to find every item with unique permissions? Run SPO Scout's permissions report on the site: it lists the libraries, lists, folders and files with unique permissions, and who has access to each, in one pass. Natively, "Show these items" lists them one library at a time, without the people.

Do unique permissions slow SharePoint down? They can. Microsoft supports up to 50,000 unique permission scopes in a list or library and recommends staying under 5,000 (Manage permission scopes in SharePoint). Sharing a folder rather than many single files keeps the count down.

Does removing someone from a site group remove their access everywhere? It removes what they held through that group, everywhere the group is used, including items with unique permissions. Anything granted to them directly, through a sharing link or through another group stays. The report shows direct grants and, with Pro, SharePoint group members; check links with the sharing link scan.

Can I see unique permissions without being a site administrator? You see what your own account can see. SPO Scout uses your session and can't exceed your permissions, so a complete picture needs an account with enough access to the site.

Does sharing a file always break inheritance? Microsoft documents that sharing a file or folder breaks its inheritance, and that each file shared on its own becomes its own permission scope, which is why sharing a folder is better than sharing many files.