SharePoint Permissions Report by User (Free Excel Export)

One of the most common SharePoint admin questions is also one of the hardest to answer:what does this specific person actually have access to across our tenant? The answer matters for Microsoft 365 Copilot readiness, leaver/joiner reviews, internal audits, and any time legal asks "did this employee ever see file X?"

This guide covers the free way to do it — without PowerShell, without ShareGate Protect, and without AvePoint Policies & Insights — using the open-source Smart Permissions SPFx web part.

Why this is hard in SharePoint Online out of the box

SharePoint's admin center shows you sharing reports and the M365 audit log shows you events, but neither one answers "effective permissions for user X right now". To answer that you have to:

• Walk every site collection in scope.
• For each site, enumerate libraries, folders, and items with broken inheritance.
• Resolve each role assignment — direct user, M365 group, security group, or sharing link.
• Flatten group membership (including nested groups) back to the user.

That's the workload you're paying ShareGate or AvePoint for — or writing a 200-line PnP PowerShell script for. See when a PowerShell script is the right answer and when a web part beats it.

Five-step report with the free Smart Permissions web part

1. Install Smart Permissions in your tenant App Catalog.
2. Add it to a SharePoint page on your governance or admin hub.
3. Switch to the People view and search for the user.
4. Let it enumerate sites, broken-inheritance scopes, and group membership.
5. Export to Excel — one row per site / library / item with permission level and grant source.

Because the web part runs as SPFx inside your tenant, the enumeration uses the signed-in admin's permissions and Microsoft Graph — no data ever leaves Microsoft 365.

What's in the export

• Site, Library/List, Item path
• Permission level (Read, Contribute, Edit, Full Control, or a custom role)
• Granted via — direct assignment, M365 group, security group, or sharing link
• Inherited? — yes/no, so you can spot the unique scopes that need attention

Copilot readiness in particular

Microsoft 365 Copilot will surface anything a user technically has access to — including the all-too-common "Everyone except external users" oversharing pattern. Running a per-user report against a typical knowledge worker before turning Copilot on tells you immediately whether your tenant is ready. Pair this with the external sharing & Copilot readiness report.

When you'd still pick a paid tool

• You need scheduled, recurring reports landing in a SOC mailbox.
• You need DLP-style policies and automated remediation, not just reporting.
• You need cross-workload coverage (OneDrive, Teams, Exchange) in a single pane of glass.

For everything else — a one-off per-user report, a Copilot readiness review, an audit response — the free web part is enough.

Related

• SharePoint Smart Permissions (free SPFx web part)
• Free SharePoint permission report (with Excel export)
• How to audit SharePoint permissions (without losing a week)
• All SharePoint permissions tools compared
• More SharePoint Smart Solutions use cases

Permissions tools

• SharePoint permission report tool — free, read-only, MIT-licensed SPFx web part.
• SharePoint permissions reporting tool — what to look for when choosing one.