Building a SharePoint permissions matrix at library level is harder than it should be. Here are the four realistic approaches and what each one costs you in time, skill, and flexibility.
| Approach | Granularity | Output format | Cross-site? | Setup required | Best for |
|---|---|---|---|---|---|
| SharePoint UI (Check Permissions) | One user, one site | On-screen only | No | None | Single ad-hoc lookups |
| Microsoft 365 / SharePoint admin center | Site-level; sharing summary only | Limited CSV export | Partial | None | High-level sharing overview |
| PnP PowerShell | Site, library, list, item level | CSV, Excel (scripted) | Yes | PowerShell + PnP module; scripting expertise required | Developers and scripting-capable admins |
| ShareMaster Report Master | Site, list, library and item level | Formatted Excel workbook | No, one site per run | Windows desktop app; no scripting | Admins who need a complete per-site audit without coding |
How each approach works
Option 1: SharePoint UI - Check Permissions
The Check Permissions function is built into every SharePoint site. Navigate to Site Settings, then Site Permissions, and use the "Check Permissions" button to enter a user's name or email address. SharePoint returns a list of the permission levels that user holds on the current site, including whether the permission was granted directly, through a group, or inherited from a parent.
The output is on-screen only. There is no export, no history, and no way to check multiple users or multiple sites simultaneously. It is useful for answering a single support question ("why can this user see this site?") but is entirely impractical for producing a permissions matrix across a real-world tenant.
Granularity stops at the site level. Check Permissions cannot distinguish between a user who has full Edit access to every library on a site and one who has been granted access to a single library within it.
Option 2: Microsoft 365 and SharePoint admin centers
The Microsoft 365 admin center provides a user-centric view: for a given account you can see which Microsoft 365 groups and SharePoint sites they belong to. The SharePoint admin center shows site-level sharing settings and, from August 2026, includes the SharePoint Admin Agent for natural-language governance queries.
Neither admin center produces a library-level permissions matrix. The SharePoint admin center's "Active sites" view exports a CSV of site names, storage, and sharing settings, but the sharing column is a summary ("Anyone with the link" / "Specific people") rather than a named list of users and their permission levels. Entra ID (formerly Azure AD) shows group memberships, but the translation from group membership to SharePoint permission level still requires cross-referencing multiple sources.
This approach works well for a quick overview of which sites allow external sharing. It is not a substitute for a permissions matrix.
Option 3: PnP PowerShell
PnP PowerShell is the most powerful option available without additional tooling. The PnP module, available from the PowerShell Gallery, provides cmdlets to enumerate sites, libraries, lists, and their permission assignments. A script can iterate every site collection in the tenant, read the unique permissions on each library, resolve group memberships, and write the results to a CSV or Excel file.
The practical barrier is authorship. Writing a reliable permissions export script requires familiarity with the SharePoint permission model (permission levels, SharePoint groups, direct user grants, unique versus inherited permissions), PowerShell error handling for throttling and timeouts, and ongoing maintenance as Microsoft updates the PnP module. A script that works in 2024 may need revision in 2026 due to API changes or throttling policy updates.
For organisations with dedicated SharePoint developers or scripting-capable admins, PnP PowerShell is a strong choice: it is free, fully flexible, and can be scheduled. For organisations where the IT administrator is also the SharePoint admin, the learning curve is steep and the maintenance burden is ongoing.
Option 4: ShareMaster Report Master
Report Master is a Windows desktop tool that connects to a SharePoint Online tenant and exports a permissions matrix to Excel without requiring any PowerShell. The connection uses the administrator's Microsoft 365 account via the standard browser-based sign-in flow.
Once connected, Report Master's Security Matrix reads one site: the permissions each principal (users, SharePoint groups and Microsoft 365 groups) holds on the site, its lists and libraries, and on individual files and list items. It needs site collection administrator rights on that site, and the output is an Excel workbook. For several sites, run it once per site.
For an IT administrator who needs to produce a permissions report for a compliance audit, a stakeholder review, or an HR-driven access removal exercise, the Excel output is immediately usable. There is no scripting, no module installation, and no throttling to manage. The tool handles retries and rate-limit back-off internally.
Report Master does not produce a single tenant-wide permissions export. For one report that covers every site in the tenant, PnP PowerShell remains the option.
Which option fits your situation
| Your situation | Recommended approach | Why |
|---|---|---|
| Single user, single site, ad hoc lookup | SharePoint UI (Check Permissions) | Fastest for a one-off question with no export needed |
| Quick overview of which sites allow external sharing | SharePoint admin center | Built-in, no setup, good enough for a sharing policy review |
| Full cross-site permissions matrix for a compliance audit | PnP PowerShell, or Report Master site by site | PnP can loop every site in one script; Report Master gives a named, item-level Excel output per site |
| Repeatable scheduled export, or one export covering every site | PnP PowerShell | Most flexible; can be automated and parameterised for any granularity |
| Compliance audit without PowerShell expertise or scripting resources | Report Master | GUI-driven, Excel output, no scripting or module maintenance required |
| Pre-migration access review before moving sites to a new tenant | Report Master | Run on each source site; Excel output documents the baseline for comparison after migration |
Most organisations will use different approaches at different times. Check Permissions handles daily support questions. The admin center handles monthly sharing reviews. For the quarterly or annual permissions audit, reach for Report Master or PowerShell. The table above is a guide, not a prescription: choose the approach that fits the deadline, the audience for the output, and the skills available.
Frequently Asked Questions
What is a SharePoint permissions matrix report?
A SharePoint permissions matrix report shows which users and groups have access to which sites, libraries, or lists, and at what permission level. A full matrix maps every account against every content container so administrators can see the complete access picture across a site or an entire tenant.
Can I export SharePoint permissions to Excel without PowerShell?
Yes. ShareMaster's Report Master exports a full permissions matrix for a site to Excel without any scripting, down to files and list items, one site per run. It connects via standard sign-in, needs site collection administrator rights on the site, and produces a filterable workbook ready for audit or stakeholder review.
Does the Microsoft 365 admin center show library-level SharePoint permissions?
No. The Microsoft 365 admin center shows site-level sharing settings and user group memberships, but does not produce a library-level permissions breakdown. The SharePoint admin center goes slightly deeper but still does not generate a cross-site, library-level matrix in a downloadable format.