SharePoint Permission Reporting Tools Compared

Quick answer

The right tool depends on how far the question reaches:

• One library or one site, right now: SharePoint's own pages, or a browser extension such as SPO Scout (ours) when you want every permission exception in a site in one report.
• Every site in the tenant, on a schedule: Microsoft's data access governance reports if you have SharePoint Advanced Management, PnP PowerShell if you can script, or a dedicated tool such as ShareGate, Syskit Point or DeliverPoint.
• Custom output or automation: PnP PowerShell.

Setup differs as much as scope. Native tools and extensions need no app registration. PnP PowerShell needs your own Entra ID app. The platforms ask a Global Administrator to consent to an app with tenant-wide access, or install into your tenant.

How this comparison was made: prices and requirements are quoted from each vendor's own pricing page and Microsoft's documentation as they read on September 27, 2026. Prices change, so check the linked page before you buy. SPO Scout is our product and is labelled as such.

Built into SharePoint

Start here. The native pages are the source of truth.

• Show these items. A library's permissions page says when some items have unique permissions and lists them in an Exceptions dialog. It shows which folders and files broke inheritance, one library at a time. See how to find unique permissions in SharePoint.
• Check Permissions. On a site's permissions page, it reports what one user or group can do on that site and which group grants it.
• Site usage sharing report. A site admin can run the Shared with external users report from Site usage and get a CSV of the site's files, users, permissions and links. SharePoint groups appear by name, not as their members, and Anyone links are not included (Microsoft: sharing reports).
• Data access governance reports. In the SharePoint admin center: snapshots of site permissions and user access across the organization, plus 28-day activity reports on sharing links. The full set needs SharePoint Advanced Management, which a tenant gets when at least one user is assigned a Microsoft Copilot license, through the SharePoint Advanced Management Plan 1 add-on, or with Microsoft 365 E7 (Microsoft: SharePoint Advanced Management prerequisites). With E5 alone you get the activity reports only, for up to 10,000 sites, without snapshots or remediation (Microsoft: data access governance reports).

PnP PowerShell

Free and open source (MIT), and the most flexible option: anything you can script, you can report, schedule and export in whatever shape you need. The cost is the scripting itself, plus one setup step that catches people out: since September 9, 2024 you must register your own Entra ID app to use it, which needs the Application Developer or Global Administrator role (PnP documentation).

Choose it for scheduled jobs, tenant-wide reports and custom output. It is slower for a one-off question on one site, where the script takes longer to write than the answer takes to find.

Browser extensions

Extensions work on the site you have open, through your own signed-in session. They see only what your account can see, cover one site at a time, and need no app registration.

• SPO Scout (ours). Finds every library, list, folder and file in a site (or one library) with unique permissions and lists the users and groups on each, and looks up what one person is granted directly or through SharePoint groups on the site and its lists, on the free plan (3 analyses a day). Pro adds SharePoint group expansion, export to CSV, PDF or JSON, a sharing-link scan of one library with remove-all, and bulk reset of unique permissions: a one-time $299 for a year for one Microsoft 365 tenant, all admins included, with no automatic renewal. It does not list the site's own permissions, expand Microsoft 365 or security groups, cover subsites, or run on a schedule.
• Syskit Site Evaluation. From Syskit. Its listing says it scans one site for shadow users, anonymous links, external access, over-privileged accounts and "Everyone" grants. It is free, part of the Syskit Lab of tools "provided as-is, without formal support".

Other SharePoint extensions are mostly for navigation, page quality or development; see SharePoint browser extensions for admins.

Tools installed in your tenant or on a computer

• DeliverPoint (Lightning Tools). Real-time or scheduled permission reports and bulk permission management, "installed as a SharePoint Framework App within your tenant". Licensed per SharePoint user: a $2,900 base per year plus $2.90 per user per year, with a free trial (DeliverPoint pricing).
• ManageEngine SharePoint Manager Plus. Windows software that reports permissions for sites, lists, folders and files, and audits changes. Licensed annually per farm or tenant; for one Microsoft 365 tenant, US$945 (Standard) or US$1,195 (Professional), with a 30-day trial (ManageEngine pricing).
• Cognillo SharePoint Essentials Toolkit. Windows desktop software with permission reports for sites, lists, libraries and items. A free Community Edition includes permission reports (Cognillo's free permission reports); Professional is $2,995 a year for one user (Cognillo pricing).

Governance platforms (SaaS)

These connect to the whole tenant, keep an inventory, and add policies and workflows on top of reporting. They need a Global Administrator to consent or connect.

• ShareGate Protect. Its Permissions matrix report shows "every permission at each level", SharePoint group members and sharing links, from a crawl that runs about every 24 hours. Priced for one tenant by licensed users (guests not included), with no minimum, through a quote builder on its pricing page; ShareGate offers a 15-day free trial (ShareGate pricing).
• Syskit Point. Microsoft 365 inventory with permission and external-sharing reports. From €10 per user per year (Management), €20 (Security) or €30 (Governance), with a minimum of 100 users, and a 21-day trial (Syskit pricing).
• GTools. Its Watchtower plan covers external-collaboration, sharing-link and permission-inheritance reports, at €7 per user per year before VAT (GTools pricing).
• AvePoint Insights for Microsoft 365. Reports overshared permissions, group membership and sensitive information. Pricing is not published (AvePoint pricing).

Side by side

How to choose

Ask three questions:

1. How far does the question reach? One site or library: native pages or an extension. Many sites, or "everything this person can open": governance reports, PowerShell or a platform.
2. Does it need to run on its own? Scheduled or repeated reporting points to PowerShell or a platform. Extensions and native pages are interactive.
3. What can you get approved? If a tenant-wide app consent is hard to get, native tools and browser extensions are the realistic options; PnP also needs admin consent, though for an app you register yourself. If budget is the constraint, the native reports and PnP cost nothing, and several vendors have free tiers or trials.

Where SPO Scout fits

SPO Scout is for the admin who needs a clear answer on the site in front of them: which libraries, lists, folders and files have unique permissions and who holds access to each, and (on Pro) who is inside each SharePoint group, without writing a script or waiting for a platform rollout. It is deliberately not a tenant-wide governance platform, and it does not replace PowerShell for scheduled work. The SharePoint permissions report page shows what the report contains and its limits.