SharePoint Permission Reporting Tools Compared

Quick answer

For a clear answer on the site in front of you, SPO Scout is a quick place to start: install the browser extension, open the site, and run the report. It lists the libraries, lists, folders and files in the site with unique permissions and who has access to each, with nothing to deploy, no app registration and no admin consent. The free plan does the reporting; Pro covers every admin in the tenant for one price.

For tenant-wide reporting on a schedule, the options are Microsoft's data access governance reports (with SharePoint Advanced Management), a PowerShell script, or a governance platform such as ShareGate, Syskit Point or DeliverPoint, each with more setup: the platforms are mostly priced per user, Microsoft's reports need SharePoint Advanced Management, and PnP PowerShell is free but needs scripting and your own Entra ID app.

How this comparison was made: SPO Scout is our product, and this is our recommendation. Other vendors' prices and requirements are quoted from their own pricing pages and Microsoft's documentation as they read on September 27, 2026. Prices change, so check the linked page before you buy.

SPO Scout (ours): answers without a rollout

• Every exception, with the people. The whole site, down to every folder and file with unique permissions in its document libraries and lists, with the users, groups and permission levels on each. With Pro, SharePoint groups expand to their members.
• One person's access. The User Permissions Report shows what someone is granted on the site and on each list and library with its own permissions, directly or through a named SharePoint group.
• Fix what you find (Pro). Remove a library's sharing links in one step, and reset items with unique permissions to inherit in bulk.
• Evidence (Pro). Export to PDF or CSV.
• No app to approve. It runs in your own SharePoint session, sees only what you can see, and keeps SharePoint data in your browser (security page).

Price: free plan with 3 analyses a day; Pro is a one-time $299 for a year for one Microsoft 365 tenant, every admin included, with no automatic renewal. Compare that with the pricing below.

What it isn't: a tenant-wide governance platform. It works one site at a time, doesn't read the site's own permission list, cover subsites or expand Microsoft 365 and security groups, and doesn't run on a schedule. The SharePoint permissions report page shows exactly what the report contains.

Built into SharePoint: what it takes

• Show these items lists one library's exceptions without the people, and Check Permissions answers for one person on one object. See how to find unique permissions in SharePoint.
• The Site usage sharing report gives a site admin a CSV of the site's shared files, users and links, with SharePoint groups by name and Anyone links left out (Microsoft: sharing reports).
• Data access governance reports in the SharePoint admin center cover the whole tenant, but the full set needs SharePoint Advanced Management: a tenant gets it when at least one user has a Microsoft Copilot license, through the SAM Plan 1 add-on, or with Microsoft 365 E7 (prerequisites). With E5 alone you get the activity reports only (data access governance reports).

PnP PowerShell: flexible, if you script

Free and open source, and anything you can script you can report and schedule. The cost is the scripting, plus a setup step that catches people out: since September 2024 you must register your own Entra ID app, which needs the Application Developer or Global Administrator role (PnP documentation). For a one-off question on one site, the script takes longer to write than the answer takes to find in SPO Scout.

Other browser extensions

• Syskit Site Evaluation (Syskit). Its listing says it scans one site for shadow users, anonymous links, external access, over-privileged accounts and "Everyone" grants. Free, part of the Syskit Lab, "provided as-is, without formal support".

The wider list is in SharePoint browser extensions for admins.

Installed tools and governance platforms

These cover more than one site, in exchange for installation or a Global Administrator's consent, and most are priced per user; the SaaS platforms add policies on top of reporting:

• DeliverPoint (Lightning Tools): permission reports and bulk management, installed as a SharePoint Framework app in your tenant. $2,900 base per year plus $2.90 per user per year, free trial (pricing).
• ManageEngine SharePoint Manager Plus: Windows software for permission reports and change auditing. For one Microsoft 365 tenant, US$945 (Standard) or US$1,195 (Professional) a year, 30-day trial (pricing).
• Cognillo SharePoint Essentials Toolkit: Windows desktop software; a free Community Edition includes permission reports (free reports), and Professional is $2,995 a year for one user (pricing).
• ShareGate Protect: a Permissions matrix from a crawl about every 24 hours; priced per licensed user through a quote builder, 15-day trial (pricing).
• Syskit Point: inventory with permission and external-sharing reports, from €10 per user per year with a 100-user minimum, 21-day trial (pricing).
• GTools Watchtower: sharing-link and permission-inheritance reports, €7 per user per year before VAT (pricing).
• AvePoint Insights for Microsoft 365: overshared permissions and sensitive information; pricing not published (pricing).

Side by side

How to choose

1. How far does the question reach? One site, now: SPO Scout. Many sites, or everything one person can open across the tenant: governance reports, PowerShell or a platform.
2. Does it need to run on its own? Scheduled reporting points to PowerShell or a platform. SPO Scout is interactive.
3. What can you get approved? If a tenant-wide app consent or a per-user budget is hard to get, SPO Scout needs neither: install it, and it works with the access you already have.

The two work well together: a tenant-wide view for the big picture, and SPO Scout for the day-to-day questions on the site in front of you. Install SPO Scout free and run your first report today.