SharePoint permissions reporting tool
Report who has access to every site, library, folder and file — with nested groups expanded to real people, external users flagged, and every scope marked Inherited or Unique. Exports to Excel. Nothing is ever changed.
Last updated
Quick answer
What is the best free SharePoint permissions reporting tool?
SharePoint Smart Permissions is a free, open-source, read-only SPFx web part that reports effective permissions across a site, its libraries, folders and files. It expands nested Microsoft 365 and Entra ID group membership to named people, surfaces sharing links and external guests, marks every scope as Inherited or Unique, and exports the whole thing to Excel. It runs client-side in your tenant with the signed-in user's permissions and cannot modify access. The built-in alternative — Site Settings → Site permissions — shows a single scope at a time and never expands groups.
Why SharePoint's built-in permissions views are not a report
SharePoint Online can tell you the permissions on one object at a time. It cannot tell you where inheritance is broken across a site, who is inside the "Marketing Owners" group, which folders were shared with a link that anyone can use, or which guests still have access after a project ended. Every access review eventually needs those four answers in one file — and that is what a permissions reporting tool produces.
What the report should contain
- Object URL and type — site, list, library, folder, file
- Whether the object is Inherited or Unique
- Principal name and type, and the group each person came through
- Permission level granted at that scope
- Sharing links, their scope, and any external or guest recipients
- A per-user lookup: everything one person can reach in the scanned scope
What people use it for
Access review / recertification
Export the site's effective permissions to Excel, filter to the Unique rows, and send owners a list of the actual people — not group names — who can reach their content.
External access audit
Filter the report to guests and sharing links to answer 'who outside the company can see this?' with a dated artifact, before a Copilot rollout or a security questionnaire.
Leaver and incident review
Use the per-user lookup to answer 'what could this person see?' across the scanned scope in minutes rather than clicking through site permission pages.
Copilot readiness
Copilot surfaces anything a user can already open. Reporting oversharing — company-wide links, everyone-except-external-users grants — before rollout is the cheapest time to fix it.
Inheritance cleanup planning
Count and locate every broken-inheritance scope so owners can decide what to restore. The report is the plan; the change itself is made in SharePoint.
Group membership transparency
Nested Microsoft 365 and Entra ID groups are expanded recursively, so the report lists the people behind each group instead of the group name.
How to run a permissions report
- Deploy the Smart Permissions .sppkg to your App Catalog and approve the delegated Graph scopes.
- Add the web part to a modern page on an admin or governance site.
- Pick the scope to scan — start with one high-risk site rather than the whole tenant.
- Run the scan and let it resolve group membership recursively.
- Export to Excel, filter to Unique scopes, guests and sharing links, and send owners their slice.
- Re-run it quarterly and keep the dated files — that history is what an auditor actually wants.
Remediation happens in SharePoint itself: the tool reports, it does not change permissions. That separation is deliberate — it means anyone with read access can produce the evidence without holding a privileged role.
Frequently asked questions
What is a SharePoint permissions reporting tool?
Software that reads who has access to SharePoint sites, libraries, folders and files, resolves group membership down to named people, and outputs it as a report you can review or hand to an auditor. SharePoint Online has no built-in equivalent — Site Settings shows one scope at a time and never expands nested groups.
Is there a free SharePoint permissions reporting tool?
Yes. SharePoint Smart Permissions is a free, read-only SPFx web part: add it to a modern page, pick a scope, run the scan, and export an Excel workbook of effective permissions including expanded Microsoft 365 and Entra ID group membership, sharing links, external users, and whether each object is Inherited or Unique.
Can I report permissions for a whole site collection?
Yes. Scope the scan at the site and it walks the lists, libraries, folders and items beneath it. Larger scopes take longer because every object with unique permissions has to be read individually — start with the sites that matter for the review rather than the whole tenant at once.
Does it show external users and sharing links?
Yes — guests and anonymous or company-wide sharing links appear in the report alongside directly assigned principals, which is normally the first thing an access review asks for.
Does the tool change any permissions?
No. It is read-only by design. It issues GET calls to Microsoft Graph and the SharePoint REST API using the signed-in user's token and builds the workbook in the browser. It cannot grant, remove or reset permissions, and no data is sent anywhere outside your tenant.
How is this different from a PowerShell permissions report?
A PnP PowerShell script can produce similar data, but you own the code: modules, authentication, throttling handling, recursion bugs and group expansion. The web part is installed once, runs from a page for any user who has read access to the scope, and produces a formatted Excel file without a scripting environment.
What do the report's Inherited and Unique categories mean?
Inherited means the object takes its permissions from its parent. Unique means inheritance was broken at that object and it carries its own assignments. Unique scopes are where access drift lives, so they are the rows to review first.