Report unique permissions
Find broken-inheritance items
Broken inheritance is what makes a library's permissions untrustworthy: the library says one thing and forty items inside it quietly say another. This lists every item whose permissions no longer come from its library, with the people and roles granted directly on it.
What it tells you
- Which items have stopped inheriting, and where they are.
- Who has been granted access directly on each one, and at what level.
- How widespread the problem is, which is the number that decides whether you fix items or reset the library.
- Optionally, the items that are still inheriting, on their own sheet, so you have both halves of the picture.
How it runs
- Sign in and choose what to scan. Clicking the tile asks which account to use and how to connect, signs you in if you are not already, and drops you straight on the site list. No feature page asks you to connect a second time. Sites, or individual libraries.
- It checks each item. Inheritance is a per-item property, so there is no shortcut. Progress is reported per item.
- Save the workbook. Unique Permissions is the sheet with the findings.
- Fix separately, if you want to. Remove unique permissions, on the Shared links menu, restores inheritance. It is a separate deliberate run.
How it works
Only document libraries are scanned, hidden ones left out. With subsites included, every subsite below is scanned at any depth. Libraries are scanned one at a time. Each library's items are read in pages, which works past the 5,000 item threshold, and every item comes back with a flag saying whether it inherits. Items that inherit cost nothing further.
For each item with its own permissions, its permissions are read, and one row is written for each person, group or link holding a visible role. Roles SharePoint hides, such as Limited Access, are left out. A permission held through a sharing link is classed as a sharing link; any other holder is a user, a security group, a SharePoint group or a distribution list. An item whose permissions cannot be read becomes an error row.
It reports items, not containers: a library or site that has broken inheritance itself is not listed here, and the Security matrix covers those. A fault in one library is recorded and the scan moves to the next. The workbook goes into History when the run ends, provided the run found something to report.
What you get
An Excel workbook, named like shared-links-contoso-projects-20260901-1422.xlsx, kept in Report History whether or not you save it. One row per principal per item, so an item granted to three people appears three times.
Unique Permissions sheet
Every item that no longer inherits.
| Column | Example |
|---|---|
| Library | Shared Documents |
| Item path | Clients/Northwind/Contract.pdf |
| Item type | File |
| Principal | Dana Reyes |
| Principal type | User |
| Roles | Full Control |
No Unique Permissions sheet
Optional. The items that are still inheriting, for the other half of the picture.
| Column | Example |
|---|---|
| Library | Shared Documents |
| Item path | Clients/Fabrikam/Notes.docx |
| Item type | File |
| Permissions | Inherited |
What you need
- Read access to the sites or libraries in scope, including permission to read item level permissions.
What it will not do
- It reads only. Restoring inheritance is a different tile, and restoring inheritance removes the direct grants listed here, which is the point but is worth being certain about.
- Item by item means slow on a large library. Scope tightly.
- For a whole-of-site permissions picture rather than a broken-inheritance list, the Security matrix is the better report.