Report app access

Every app that can reach your sites

Applications can be given access to SharePoint two ways: one site at a time through Sites.Selected, or to every site at once through a tenant-wide Sites permission. This lists both. For each site it reads which apps have been granted access and with which role, and it can list the apps that hold a Sites application permission in your directory: those whose permission reaches every site without any grant, and those holding Sites.Selected.

What it tells you

• Which applications can read or change each site, and with which role.
• Which apps hold Full control somewhere, and on how many sites.
• Which apps can reach every site through a tenant-wide Sites permission, and which hold Sites.Selected.
• Whether a grant's name matches the app's real name in your directory. A grant can be given any name, so a mismatch is worth checking.
• Which apps were registered by another organisation.

How it runs

1. Sign in and pick sites. Clicking the tile asks which account to use and how to connect, signs you in if you are not already, and drops you straight on the site list. No feature page asks you to connect a second time. Every site starts ticked; untick the ones to leave out.
2. Choose the options. Tenant-wide holders and directory names need App authentication. On other sign-ins those boxes are off and the workbook says why.
3. It reads each site. One small request per site. A site that refuses is asked about once, then listed under Not read.
4. Save the workbook. Five sheets: Summary, Site grants, By app, Tenant-wide and Not read. The report goes into Report History only when you save it.

How it works

Sites are read one at a time. For each, the full list of apps granted access to that site is read, with each grant's role and the name it was given when it was granted. On the first site that refuses, you are asked once whether to carry on or stop, and that answer covers every later refusal. A refused or failed site goes on Not read with SharePoint's reason, and sites not reached because you stopped are marked Not reached.

After the sites, each distinct app is looked up once in your directory for its real name, its owning organisation and its publisher. If the directory refuses, no further lookups are made. Name mismatch is Yes when the directory name and the name given at grant are both present and differ, ignoring case and surrounding spaces. Owner tenant compares the app's home organisation with yours: This tenant, Another organisation, or Unknown.

Tenant-wide holders are found from the other direction: for SharePoint and for Microsoft Graph, it reads which applications hold a Sites permission. Sites.Read.All, Sites.ReadWrite.All, Sites.Manage.All and Sites.FullControl.All reach every site. Holders of Sites.Selected are listed on the same sheet, though they reach only the sites that grant them access. The directory is read only on the App authentication sign-in; on other sign-ins both directory sheets say why they are empty.

The workbook is written when you save it, and it is added to History at that point.

What you get

An Excel workbook, named like ShareMaster-app-access-contoso.sharepoint.com-20261007-142207.xlsx, kept in Report History whether or not you save it. Name mismatch is the column to look at first: the name given at grant time is free text.

Summary sheet

Tenant, scope, counts, and anything that was not read and why.

Site grants sheet

One row per app grant on each site.

By app sheet

One row per app across every site read.

Tenant-wide sheet

Apps holding a Sites application permission: the tenant-wide ones that reach every site, and Sites.Selected, which reaches only the sites that grant it.

Not read sheet

Every site that refused or failed, with the reason.

What you need

• Site collection administrator on a site, in practice, to read its app grants. A certificate sign-in reads them as ShareMaster's own app.
• App names and the Tenant-wide sheet need App authentication with permission to read applications in your directory (Application.Read.All).

What it will not do

• A site that could not be read is listed under Not read with SharePoint's reason. It is never counted as a site with no apps.
• Grants made to a single list or item (Lists.SelectedOperations.Selected) are not covered.
• It reads only. To grant, change or revoke an app on a site, use App permissions on the Shared Links menu.

See every feature