SharePoint Permissions Report
Find every library, list, folder and file in a SharePoint site with unique permissions and see who has access to each. Expand groups, review sharing links and export the results — directly from your browser, without PowerShell.
No PowerShell. No app registration. Free to start — Pro is $299/year per tenant, all admins included.
What you can do in the first minute
Install SPO Scout, open any SharePoint site you administer, and run a permission report in the side panel. You get every library, list, folder and file whose inheritance is broken, the users and groups on each with the permission level each one holds, and which libraries and lists still inherit from the site. On Pro it also resolves each group to the people inside it, scans the library for sharing links, and exports to CSV, PDF or JSON for the audit file. Nothing is installed on a server and nothing is scheduled — you point it at what you need to see and it answers.
What the report shows
- Who has access
- Every principal with a role assignment on each object with unique permissions — individual users, SharePoint groups, Microsoft 365 groups and security groups.
- What they can do
- The permission level behind the access: Full Control, Edit, Contribute, Read, or a custom role definition your tenant has defined.
- How they got it
- Whether an object inherits from its parent or has its own permissions, and whether each assignment is made to a person directly or to a group.
- Inherited or unique
- Objects with broken inheritance are flagged, so the exceptions stand out instead of hiding in a long list.
- Group membership
- SharePoint groups are expanded to the accounts inside them, so "Finance Reviewers" resolves to the people it actually contains (Pro). A Microsoft 365 or security group is listed as one entry.
- Sharing links
- A separate scan lists the sharing links published on items in the library, up to 2,000 items per scan — including the broad "Anyone with the link" type that audits usually look for — and can remove all of them in one step (Pro).
- Scope
- A whole site, including every folder and file with unique permissions in its document libraries and custom lists, on Free. The site’s own permissions page, subsites and other list types (such as Site Pages, picture libraries, calendars and task lists) are not included; expanding groups to their members is Pro.
How it works
Open the SharePoint site
Browse to it the way you normally would. You are already signed in, and that session is what SPO Scout uses.
Open SPO Scout in the side panel
Click the extension icon. It docks beside SharePoint rather than covering it, so you keep your bearings.
Run the permission analysis
Run Permissions Report for the whole site, including every folder and file with unique permissions, or Permissions Report (Expanded) to resolve groups to their members, which is the Pro option.
Review unique access and expand groups
Work through what broke inheritance and who is actually inside each group, instead of guessing from group names.
Export, or clean up in place
Export to CSV, PDF or JSON for the audit file. Or remove sharing links in bulk and reset unique permissions back to inherited (Pro).
Site, library, folder, file — four scopes, one question
SharePoint permissions cascade down a hierarchy, and an access problem can be introduced at any level of it. Reporting at the wrong scope is the usual reason an audit misses something.
Site
FreeWho can reach the site collection at all, through its Owners, Members and Visitors groups or through direct grants. The right starting point for an access review. The site’s own permissions page shows this; in SPO Scout, the user lookup covers it for one person at a time.
Library or list
FreeWhether a library still inherits from the site, and who has been added to it directly. This is where the first exceptions usually appear.
Folder
FreeA folder shared once for a project and never cleaned up is the classic finding. Broken inheritance at folder level is invisible from the site permissions page.
File
FreeIndividual documents shared with a person or a link, independently of everything above them.
Unique versus inherited permissions
By default every library, folder and file inherits its permissions from the site above it. Inheritance breaks the moment someone shares a single document, adds a person to one folder, or changes a library's permissions directly. SharePoint does this quietly and does not announce it.
Unique permissions are not a fault in themselves — sometimes a folder genuinely should be restricted. The problem is the ones nobody remembers creating. A contractor added to one folder years ago still has access today, and no site-level report will ever show it. SPO Scout flags the objects that have broken inheritance so those exceptions surface as a list rather than as a discovery during an audit. On Pro you can reset an object back to inherited once you have decided the exception is no longer wanted.
Group expansion
A permission report that stops at "Finance Members — Edit" has not answered the question. Whoever asked wants names. Group expansion (Pro) resolves SharePoint groups to the accounts inside them, so the report you hand to a compliance officer lists people rather than containers.
Know where it stops. A Microsoft 365 or security group sitting inside a SharePoint group is listed as a single entry, and on a site connected to a Team that is how the Members and Owners groups are built. Access granted through a Team's membership is easy to overlook for exactly that reason, so check the Team's members in Teams or the Microsoft 365 admin center alongside the report.
External users and sharing links
Sharing links sit alongside the permission model rather than inside it, which is why they are so often missed. SPO Scout's shared-links scan (Pro) lists the links published on items in a library, up to 2,000 items per scan — including the broad "Anyone with the link" type that does not require the recipient to sign in — and can remove all of the links it found in one step.
Microsoft does offer native sharing reports: a site admin can export one site's sharing as a CSV from Site usage, and the SharePoint admin center reports across the tenant. For an inventory, those are the right tools. The difference is where you are standing: SPO Scout answers the question while you are already looking at the library, and lets you act on the answer in the same place. Use both.
For the sharing side of an access review — link types, Anyone links, the routes external access takes — see the SharePoint external sharing report.
Related reading: cleaning up 8,000 sharing links before a compliance audit.
Exporting the report
Pro exports to CSV for spreadsheet work, PDF for the audit file, and JSON if you are feeding another system. Exports are generated in the browser and saved by your browser's own download manager — the data does not pass through us on the way.
The Free tier displays reports in the extension and keeps your five most recent actions in history. It does not export. If the deliverable is a file for somebody else, that is what Pro is for.
Native SharePoint, PowerShell, or SPO Scout
These solve overlapping but genuinely different problems. PowerShell is not the wrong answer — it is the right answer for automation, and no browser extension replaces it there.
| Criterion | Native SharePoint | PowerShell / PnP | SPO Scout |
|---|---|---|---|
| Setup required | None | Install modules, authenticate, often register an app | Install a browser extension |
| Visual interface | Yes, one object at a time | No — console output | Yes, whole scope at once |
| Ad-hoc "who has access to this?" | Slow — click through each object | Fast once a script exists | Fast, no script needed |
| Recursive scan of a library | Lists the exceptions (Show these items), not who holds them | Yes | Yes |
| Export to CSV / PDF | Site sharing report (CSV, site admins, groups not expanded) | Yes, with code | Yes, built in (Pro) |
| Scheduled / unattended runs | No | Yes — this is where PowerShell wins | No, it is interactive by design |
| Custom logic and bespoke output | No | Yes — anything you can code | No, fixed report shapes |
| Works without scripting skills | Yes | No | Yes |
A longer comparison lives in SharePoint admin extension vs PowerShell, and the step-by-step guide is how to generate a SharePoint permissions report without PowerShell.
Where the permission data goes
Nowhere. Permission data is read from SharePoint through your existing signed-in session, analyzed in the browser and displayed there. It is not sent to SPO Scout servers, and there is no Entra ID app registration or tenant-wide admin consent involved — which also means the extension can never see more than your own account can.
See how SPO Scout handles data & securityPricing
Free
$0
- 3 analyses per day
- Permission reports down to item level
- User permission lookup
- 5 most recent actions in history
Pro
$299/year
- Unlimited analyses
- Group expansion — groups resolved to the people inside them
- Sharing-link scan and bulk removal
- Reset unique permissions back to inherited
- CSV, PDF and JSON export
One tenant. All your admins. $299/year.
SharePoint permission reporting questions
- How do I generate a SharePoint permissions report?
- Open the SharePoint site in your browser, open SPO Scout in the side panel, and run the permission analysis. The report lists the principals on every library, list, folder and file with unique permissions, the permission level behind each, and which lists and libraries inherit. Exporting to CSV, PDF or JSON requires Pro.
- Can I audit SharePoint permissions without PowerShell?
- Yes. SPO Scout reads permissions through the SharePoint REST API in your existing browser session, so there are no modules to install, no authentication to configure and no script to maintain. PowerShell remains the better tool for scheduled or unattended reporting across a whole tenant.
- Can I see folder and file level permissions?
- Yes, on the Free tier. The report walks the folders and files in each list and library and lists the role assignments on any whose inheritance has been broken. Resolving groups to the people inside them is the Pro part.
- Can SPO Scout show which items have unique permissions?
- Yes. Objects that have broken inheritance are flagged in the report, so you can see where the exceptions are rather than reading through every entry. Pro can also reset unique permissions back to inherited.
- Can it expand groups to the people inside them?
- SharePoint groups, yes, with Pro. Group membership expansion resolves a SharePoint group to the accounts inside it, so a report shows the people who actually have access rather than a group name. A Microsoft 365 or security group, including the one behind a Team, is listed as a single entry; its members are managed in Teams or the Microsoft 365 admin center.
- Can I export the report?
- Pro exports to CSV, PDF and JSON. The Free tier displays reports in the extension and keeps your five most recent actions in history, but does not export.
- Does SPO Scout upload my SharePoint data?
- No. Permission data is read, analyzed and rendered entirely in your browser. The only requests that leave your browser for our servers are the license checks and the optional feedback form, none of which carries SharePoint data.
- Do I need tenant-wide admin consent?
- No. SPO Scout has no Entra ID app registration and requests no Microsoft Graph permissions. It uses the SharePoint session you are already signed in to, which also means it can never see more than your own account can.
- How much does it cost?
- The Free tier runs three analyses a day. Pro is $299 per year for one Microsoft 365 tenant, with every admin in that tenant included — there is no per-user pricing.
Run your first permission report today
Install free, open a SharePoint site you administer, and see who has access. No PowerShell, no app registration, no credit card.
Permissions guides
Practical walkthroughs for the audits this report is built for.
- How to Find Unique Permissions in SharePoint Online →
Find the libraries, lists, folders and files with unique permissions in a SharePoint site, and who has access to each, in one SPO Scout report.
- SharePoint Permission Reporting Tools Compared →
SharePoint permission reporting tools compared, and why SPO Scout is a quick start: every exception, who has access, and no app registration.
- How to See Who Has Access to a SharePoint Folder →
See who can open a SharePoint folder, and every folder with its own permissions in a site, in one SPO Scout report. Group members and links on Pro.
- How to See Who Has Access to a SharePoint File →
See who can open a SharePoint file, and every file with its own permissions in a site, in one SPO Scout report. Group members and sharing links on Pro.
- How to Check What a User Can Access in SharePoint →
SPO Scout's free User Permissions Report shows, in one search, what a person is granted directly or through SharePoint groups on a site and its lists.
- SharePoint Permission Inheritance: How Broken Inheritance Works →
How SharePoint permission inheritance works, why broken inheritance piles up, and how SPO Scout shows the exceptions in a site with who has access to each.
- How to See Who Is Inside SharePoint Permission Groups →
See who is inside the SharePoint groups on a site's libraries, folders and files, not just group names: SPO Scout's expanded report lists members (Pro).
- How to Audit External Sharing in SharePoint Online →
The six kinds of SharePoint sharing to audit, and how SPO Scout lists shared items on a site and Anyone links in a library (Pro).
- How to Find Anyone Links in SharePoint Online →
Find Anyone links in a SharePoint library in one scan: SPO Scout lists items with sharing links and each link's type, and can remove them all (Pro).
- Everyone Except External Users in SharePoint: What It Means and What to Audit →
What Everyone except external users means, when it's fine and when it isn't, and how SPO Scout shows where it's granted on a site's libraries and files.
- How to Review SharePoint Access During Employee Offboarding →
When someone leaves, disabling the account isn't enough. SPO Scout shows their direct and group access on each site, and each library's sharing links (Pro).
- SharePoint Permission Levels Explained →
Full Control, Edit, Contribute, Read and Limited Access explained, why Edit lets Members delete whole libraries, and how SPO Scout reports each level.
- Audit SharePoint Permissions Before Microsoft 365 Copilot Rollout →
Copilot respects permissions but makes forgotten access easy to find. How to find the permission debt first, site by site, with SPO Scout, before your rollout.
For what SPO Scout does beyond permission reports, see the SharePoint admin extension overview.