Permissions matrix report

Uncover the access your users and groups have in your environments with a Permissions matrix report.

Index

• Prerequisites
• How-to
• Report options
  • Users and groups
  • Object types
  • Setup automatic export for this report's results
• Results
  • Inherited Permissions
  • Levels
  • Guest Links and External User Invitations
  • Export

Prerequisites

• You are connected to your site collection(s), Microsoft 365 Admin center, or SharePoint central admin.
• You have site collection admin permissions on your targeted site collection(s).
  
  Note: To avoid any possible error messages while running the report, it is best practice to have site collection admin permissions even if you have higher privileges like SharePoint admin or global admin permissions. When running the report on a OneDrive for Business, it is essential to have site collection admin permissions. For more information, see Administrative permissions and Security settings - Auto-assign as a site collection administrator.

Tip: To manage all your site collections, you can connect to your central admin or admin center with SharePoint admin, farm admin, or global admin permissions.

How-to

1. Click Security.
2. Click Run permissions matrix report under Security essentials.
3. Select the target of the report.
4. Click Next.
5. Set your options (see below for details).
6. Click Schedule or Run now.

Tip: Alternatively, you can run the report from Explorer. Select the target first, then click Permissions matrix report from the Quick actions menu.

Note: The Permissions matrix report scans all the objects in your target to find your permissions. If you run into issues while running the report on a whole tenant or a lot of sites, try running the report in batches of smaller targets (i.e. a few sites at a time instead of the whole tenant).

Report options

Users and groups

Select All users and groups, External users, or Specific users and groups. If you select Specific users and groups, begin typing the user's name, and select the appropriate user from the dropdown.

Object types

Select whether or not you wish to include lists and list content in the scope of the report.

Note: For your list content the report will only show you permissions on folders, documents, and list items that have custom permissions (i.e. permissions not inherited by the parent).

Setup automatic export for this report's results

For more information, see Setup automatic export to a SharePoint library.

Results

Inherited Permissions

View the inherited permissions on any item by clicking on View next to it.

Levels

Permissions for SharePoint groups and Active Directory security groups are not initially expanded. To view the members of a given group, you can expand the group by clicking on the expand button.

Expanding a group will add all the group's members to the permissions matrix so you can see the unique permissions each member has.

To expand or collapse all groups, use the Expand all groups and Collapse all groups buttons at the top right of the report.

Note: If you are exporting your results to Excel, you should expand all groups so that you have access to the permissions matrix information of all members.

Guest Links and External User Invitations

Guest Links: SharePoint in Microsoft 365 has a feature called Guest Links which allows you to easily share documents with external, anonymous users. There are 2 types of links depending on the permissions that should be given out to anyone with the link: View Only and Edit. By default, these links do not exist and must be enabled manually. When this happens, SharePoint creates hidden user accounts, one for each link type: Guest Reader and Guest Contributor. The ShareGate migration tool represents these accounts in the Permissions matrix report as a single user account, Anonymous Guest Link with Contribute and/or Read access, allowing you to quickly gather the documents that are accessible from outside your enterprise.

External User Invitations: Sites, lists, libraries, and documents can be shared with external users in Microsoft 365, through the means of an invitation. Invitations usually expire after a week. Since these invitations can be used to access certain resources in your site, the ShareGate migration tool displays them in the Permissions matrix report. As long as the invitation is not accepted and doesn't expire, an entry will be added in the Permissions matrix report displaying the email address associated with the invitation, along with a special icon.

External users can also be invited to SharePoint groups. These invitations are displayed in the Permissions matrix report upon expanding their associated SharePoint group.

Export

Click the Export button to export the report to Excel.

Training video: For more info, watch Audit Permissions.