4 Ways to Change SharePoint Permissions in Bulk: Options Compared

Applying permissions to hundreds of sites, libraries, or list items one at a time is one of the most time-consuming tasks in SharePoint administration. Here is how the four main approaches compare.

Method 1: Entra ID security groups

The fastest path to granting a single permission level to a large number of users is an Entra ID (formerly Azure AD) security group. Add the group to a SharePoint site's Members or Visitors list once, then manage membership from the Entra ID admin centre. New members of the group inherit the permission automatically. Members who leave the group lose access the next time the SharePoint permission cache refreshes, typically within an hour.

This approach scales without limit: one group assignment covers ten users or ten thousand. It is also the model Microsoft 365 Groups use behind the scenes for every Teams channel and SharePoint team site. If a user is added to the Microsoft 365 Group backing a site, they get the corresponding SharePoint site member permission without any SharePoint admin action required.

The limitation is granularity. Entra ID groups apply at the site or library level, not at the folder or item level. If the goal is to assign different permissions to different folders within one library, or to grant access to specific list items, groups alone are not sufficient. And if permissions have already sprawled across dozens of sites with individually assigned users and custom permission levels, a group-based approach cannot untangle the mess without an audit step first.

What Entra ID groups handle well

• Adding an entire department or team to a collection of sites in one step
• Onboarding new employees with a consistent access baseline across multiple SharePoint sites
• Ensuring that changes to group membership propagate to SharePoint without requiring a separate admin action
• Maintaining access as staff move between roles without manually editing SharePoint permissions

What Entra ID groups do not handle

• Per-library or per-folder permission changes on existing sites with complex inheritance
• Removing individually assigned permissions from items that broke inheritance over time
• Auditing who currently has access to what before deciding what to change
• Bulk removal of sharing links that were created outside the normal permission model

Method 2: SharePoint Admin Centre

The SharePoint admin centre provides a UI for site-level access management without requiring any scripting. From the Sites list, an admin can select a site and adjust its sharing settings, add a secondary site collection administrator, or change the sensitivity label applied to the site. For sites using the Microsoft 365 Group connection model, membership changes take effect immediately.

The practical ceiling for this approach is low. There is no bulk-select mechanism for applying the same change to fifty sites at once. Each site requires its own navigation sequence. For small tasks, such as adding one person as a site collection admin to three or four sites, the admin centre is perfectly adequate. At larger scale, the manual overhead grows linearly with the number of sites.

The admin centre also does not expose library-level or item-level permissions. Those still require navigating to the library itself and using the SharePoint permission management pages, which adds even more clicks per change.

Method 3: PnP PowerShell and Microsoft Graph API

PnP PowerShell wraps the SharePoint REST and CSOM APIs in readable cmdlets designed for admin automation. A script can enumerate all site collections matching a naming pattern and apply or remove a permission level for a specific group in a single loop. The same script runs against ten sites or ten thousand. Microsoft Graph covers equivalent permission operations at the drive-item level in SharePoint via the OneDrive for Business endpoint model.

This is the right approach when the change follows a consistent rule expressible in code, when the admin team is comfortable with PowerShell, or when permission changes need to run on a schedule or as part of a deployment pipeline. The cost is the time to write and test the script, and the risk: a mistake in a loop can affect every site it touches before anyone notices. Running against a test tenant first, and exporting a full permission report before any destructive change, are standard precautions.

Common PnP PowerShell cmdlets for bulk permission operations

Method 4: ShareMaster

ShareMaster approaches permissions from the audit-first direction. Before changing permissions, you need to know what currently exists: which users have unique access to which libraries, which sharing links are still active, and which items have broken inheritance. The Report Master component exports that data to Excel, producing a full permissions matrix you can analyse before deciding what to change. This step is often what reveals why permissions are in their current state in the first place.

For the remediation step, ShareMaster's Shared Links and Permissions tool can bulk-remove sharing links and unique permissions across a site or library without writing a script. This is particularly useful after an audit reveals that hundreds of files have active "anyone with the link" links that should have expired months ago, or that former contractors still hold item-level access to sensitive document sets.

ShareMaster is not the right tool for assigning new permissions to large numbers of users. That task is better handled with Entra ID groups or a PowerShell script. Where it excels is the audit-to-remediation workflow: export exactly what exists, decide what to remove, bulk-remove it, then verify with a second export.

Decision matrix

In practice, a thorough permissions remediation project uses all four approaches in sequence. Start with a ShareMaster audit to establish the current state. Use Entra ID groups to build a clean, sustainable access model going forward. Apply targeted bulk changes with PnP PowerShell. Use the admin centre for the final exceptions. The full workflow is covered in the ShareMaster guide to remediating permissions after an audit.