Security matrix

Who can see what, and where

The permissions report you are asked for during an audit. It walks the scope you pick and lays out every permission on it, then expands SharePoint groups, Microsoft 365 groups and sharing links down to the actual people, so "Contoso Owners" becomes a list of names rather than another thing to look up.

What it tells you

• Who has access to a site, a library or a list, and at what permission level.
• The real people behind every group, expanded. A Microsoft 365 group is expanded to its direct members; a group nested inside it is shown as one member, not expanded.
• How a group got its access, which on a modern site is almost never a direct assignment but a place inside the site's own Owners, Members or Visitors group.
• Which lists have broken inheritance, and how many items inside them have permissions of their own.
• Every sharing-link group on the scope and who it reaches, alongside the permissions, rather than in a separate report.
• Item level: every individual file or folder with its own permissions. On by default; untick it for a quicker run.

How it runs

1. Sign in and pick a scope. Clicking the tile asks which account to use and how to connect, signs you in if you are not already, and drops you straight on the site list. No feature page asks you to connect a second time. Site collections, sites, libraries, lists or folders.
2. Choose the depth. Item level is on by default. It is thorough and considerably slower; untick it for a quick site and library level run.
3. It reads and expands. Assignments first, then every group is expanded to its members, then sharing links are resolved to who they were shared with.
4. Save the workbook. A tab per list, plus tenant-wide tabs for groups and links.

How it works

Each site you tick expands to all of its lists and libraries that are not hidden, and, when you include subsites, to every subsite below it at any depth. The work then runs in order: each site's own permissions, then the SharePoint groups of its site collection, read once per site collection rather than once per site, then each list's permissions and, at item level, its items. Microsoft 365 and security groups are expanded last, once each, however many places they appear. Everything is read one thing at a time.

A site's permissions are always read. A list's permissions are read only when it has broken inheritance, because otherwise they are the site's. Roles that SharePoint marks as hidden, such as Limited Access, are dropped, and a person or group left with no visible role is dropped with them. Each holder is classed as a person, a SharePoint group, a Microsoft 365 or security group, a sharing link, or a tenant administrator role; administrator roles are named but not expanded. SharePoint groups hidden from the site's interface are left out.

A Microsoft 365 or security group is included when it holds a permission itself, or when it is a member of any SharePoint group in the site collection; in the second case that SharePoint group is recorded as the route, and a SharePoint group that grants nothing is labelled as such. A group added through its owners only is expanded to its owners only. Expansion lists the group's direct members as the directory returns them. With expansion turned off, or on a sign-in that cannot read the directory, groups are named but not expanded and the Summary sheet says why.

Only cancelling stops the run. Every site, list, group and item read is recorded as complete, partial or failed with a reason. A list whose permissions cannot be read is not walked for items, and an item that fails marks its list partial while the walk continues. A SharePoint group whose members cannot be read is still listed, marked as not accounted for. Item level uses the same reader as Report unique permissions, so the two agree. The workbook goes into History as soon as the run ends; with several site collections, saving offers one workbook or one per site, and beyond 200 lists the rest share an Other lists tab.

What you get

An Excel workbook, named like security-matrix-contoso-projects.xlsx, kept in Report History whether or not you save it. Reached via on the O365 Groups sheet is the column that saves the most time: it is why a group has access, not just that it does.

Summary sheet

Scope, options and counts.

Web Permissions sheet

Site level assignments, per web in scope.

SharePoint Groups sheet

Each SharePoint group with its members.

O365 Groups sheet

Microsoft 365 groups expanded to their members.

Sharing Links sheet

Each sharing-link group on the scope with its members. It does not show the link's URL, scope or expiry; Report shared links does.

Shared Documents sheet

One tab per list or library, with its own assignments and, with item level on, the files and folders that have their own permissions. Past 200 lists the rest share an Other lists tab.

What you need

• Enough access to read permissions on the scope. In practice that means site collection administrator on the sites you point it at.
• Expanding Microsoft 365 group membership needs directory read permission on the sign-in. Without it, groups appear but their members do not, and the workbook says which is which.

What it will not do

• Item level multiplies the work by the number of items. On a large library it is a long run, and the app says so before you start it rather than after.
• A permission granted through a Microsoft 365 group that ShareMaster could not expand is shown as unexpanded rather than as no access.
• It reads only. It has no button that changes a permission.

See every feature