Building a SharePoint permissions matrix at library level is harder than it should be. Here are the four realistic approaches and what each one costs you in time, skill, and flexibility.
| Approach | Granularity | Output format | Cross-site? | Setup required | Best for |
|---|---|---|---|---|---|
| SharePoint UI (Check Permissions) | One user, one site | On-screen only | No | None | Single ad-hoc lookups |
| Microsoft 365 / SharePoint admin center | Site-level; sharing summary only | Limited CSV export | Partial | None | High-level sharing overview |
| PnP PowerShell | Site, library, list, item level | CSV, Excel (scripted) | Yes | PowerShell + PnP module; scripting expertise required | Developers and scripting-capable admins |
| ShareMaster Report Master | Site and library level | Formatted Excel workbook | Yes | Windows desktop app; no scripting | Admins who need a complete cross-site audit without coding |
How each approach works
Option 1: SharePoint UI - Check Permissions
The Check Permissions function is built into every SharePoint site. Navigate to Site Settings, then Site Permissions, and use the "Check Permissions" button to enter a user's name or email address. SharePoint returns a list of the permission levels that user holds on the current site, including whether the permission was granted directly, through a group, or inherited from a parent.
The output is on-screen only. There is no export, no history, and no way to check multiple users or multiple sites simultaneously. It is useful for answering a single support question ("why can this user see this site?") but is entirely impractical for producing a permissions matrix across a real-world tenant.
Granularity stops at the site level. Check Permissions cannot distinguish between a user who has full Edit access to every library on a site and one who has been granted access to a single library within it.
Option 2: Microsoft 365 and SharePoint admin centers
The Microsoft 365 admin center provides a user-centric view: for a given account you can see which Microsoft 365 groups and SharePoint sites they belong to. The SharePoint admin center shows site-level sharing settings and, from August 2026, includes the SharePoint Admin Agent for natural-language governance queries.
Neither admin center produces a library-level permissions matrix. The SharePoint admin center's "Active sites" view exports a CSV of site names, storage, and sharing settings, but the sharing column is a summary ("Anyone with the link" / "Specific people") rather than a named list of users and their permission levels. Entra ID (formerly Azure AD) shows group memberships, but the translation from group membership to SharePoint permission level still requires cross-referencing multiple sources.
This approach works well for a quick overview of which sites allow external sharing. It is not a substitute for a permissions matrix.
Option 3: PnP PowerShell
PnP PowerShell is the most powerful option available without additional tooling. The PnP module, available from the PowerShell Gallery, provides cmdlets to enumerate sites, libraries, lists, and their permission assignments. A script can iterate every site collection in the tenant, read the unique permissions on each library, resolve group memberships, and write the results to a CSV or Excel file.
The practical barrier is authorship. Writing a reliable permissions export script requires familiarity with the SharePoint permission model (permission levels, SharePoint groups, direct user grants, unique versus inherited permissions), PowerShell error handling for throttling and timeouts, and ongoing maintenance as Microsoft updates the PnP module. A script that works in 2024 may need revision in 2026 due to API changes or throttling policy updates.
For organisations with dedicated SharePoint developers or scripting-capable admins, PnP PowerShell is a strong choice: it is free, fully flexible, and can be scheduled. For organisations where the IT administrator is also the SharePoint admin, the learning curve is steep and the maintenance burden is ongoing.
Option 4: ShareMaster Report Master
Report Master is a Windows desktop tool that connects to a SharePoint Online tenant and exports a permissions matrix to Excel without requiring any PowerShell. The connection uses the administrator's Microsoft 365 account via the standard browser-based sign-in flow.
Once connected, Report Master reads permissions across all site collections in scope: who holds which permission level, whether the grant is direct or through a SharePoint group, and whether the permission is inherited from the site or unique to a specific library. The output is a formatted Excel workbook with one row per user-library pair, filterable by site, library, permission level, or account type (internal user, external user, Microsoft 365 group, SharePoint group).
For an IT administrator who needs to produce a permissions report for a compliance audit, a stakeholder review, or an HR-driven access removal exercise, the Excel output is immediately usable. There is no scripting, no module installation, and no throttling to manage. The tool handles retries and rate-limit back-off internally.
Report Master does not produce item-level permissions reports. For item-level detail across a large library, PnP PowerShell remains the more granular option.
Which option fits your situation
| Your situation | Recommended approach | Why |
|---|---|---|
| Single user, single site, ad hoc lookup | SharePoint UI (Check Permissions) | Fastest for a one-off question with no export needed |
| Quick overview of which sites allow external sharing | SharePoint admin center | Built-in, no setup, good enough for a sharing policy review |
| Full cross-site permissions matrix for a compliance audit | Report Master or PnP PowerShell | Only these two produce a named, cross-site, library-level output |
| Repeatable scheduled export, or item-level granularity needed | PnP PowerShell | Most flexible; can be automated and parameterised for any granularity |
| Compliance audit without PowerShell expertise or scripting resources | Report Master | GUI-driven, Excel output, no scripting or module maintenance required |
| Pre-migration access review before moving sites to a new tenant | Report Master | Fast to run across all source sites; Excel output documents the baseline for comparison after migration |
Most organisations will use different approaches at different times. Check Permissions handles daily support questions. The admin center handles monthly sharing reviews. For the quarterly or annual permissions audit, reach for Report Master or PowerShell. The table above is a guide, not a prescription: choose the approach that fits the deadline, the audience for the output, and the skills available.
Frequently Asked Questions
What is a SharePoint permissions matrix report?
A SharePoint permissions matrix report shows which users and groups have access to which sites, libraries, or lists, and at what permission level. A full matrix maps every account against every content container so administrators can see the complete access picture across a site or an entire tenant.
Can I export SharePoint permissions to Excel without PowerShell?
Yes. ShareMaster's Report Master exports a full cross-site permissions matrix to Excel without any scripting. It connects to your SharePoint Online tenant via standard admin sign-in and produces a formatted, filterable workbook ready for audit or stakeholder review.
Does the Microsoft 365 admin center show library-level SharePoint permissions?
No. The Microsoft 365 admin center shows site-level sharing settings and user group memberships, but does not produce a library-level permissions breakdown. The SharePoint admin center goes slightly deeper but still does not generate a cross-site, library-level matrix in a downloadable format.