When a user leaves a project, changes roles, or triggers a security alert, you need to know exactly what SharePoint sites and libraries they can access. SharePoint Online has no single screen that answers this question. Access comes from three separate sources: site group membership, direct permission grants, and sharing links. Finding all three requires knowing where to look.
What "user permission" means in SharePoint Online
In SharePoint Online, a user's effective access to content is determined by the combination of three independent mechanisms. Permission levels (Read, Contribute, Edit, Full Control) define what a user can do within a site or library. These can be assigned through site group membership or as direct grants to an individual at the site, library, folder, or item level. Sharing links are a third, separate mechanism: a URL granted to a specific person's email address, giving them access to a file or folder independently of whether they are a member of the site.
Understanding this distinction matters because removing a user from a SharePoint site group does not revoke their sharing link access. The two sources of access must be reviewed and removed separately. A user with no group membership can still have access to dozens of files across a site via sharing links that were created months or years earlier.
Method 1: Check permissions via the SharePoint admin center
The SharePoint admin center gives you a tenant-wide view of site collections and their membership. To check a specific user's site-level access:
- Sign in to the Microsoft 365 admin center and navigate to Admin centers > SharePoint.
- In the SharePoint admin center, select Active sites from the left navigation.
- Find the site you want to check. Use the search bar at the top of the list to filter by site name or URL.
- Click the site name to open the detail panel on the right side of the screen.
- Select the Membership tab in the detail panel. This lists site owners, members, and visitors by their group roles.
- Search within the membership tab or scroll to find the user. Their presence here confirms they have site-level group membership access.
This method works well for confirming whether a user is a member of a given site. Its limitation: it shows group membership only, not direct permission grants at the library or item level, and not sharing links. For a complete picture, use Method 2 or Method 3 below.
Method 2: Use the site-level Check Permissions feature
Where to find Check Permissions on a SharePoint site
SharePoint Online includes a built-in Check Permissions tool on every site that shows a specific user's effective access. To access it:
- Navigate directly to the SharePoint site in a web browser. You must be a site owner or site collection administrator to use this feature.
- Click the gear icon (Settings) at the top right of the site and choose Site permissions.
- In the Site permissions panel, look for the Advanced permissions settings link at the bottom of the panel. Click it. This opens the classic site permissions page.
- On the classic permissions page, click Check Permissions in the ribbon at the top.
- In the dialog that appears, enter the user's name or email address. Click Check Now.
- SharePoint returns a list of permission levels the user holds on the site, along with the source of each permission (site group name, direct grant, or sharing link).
What Check Permissions shows and what it misses
Check Permissions shows the user's effective permission level on the site itself and reveals whether the access came from a group, a direct grant, or a sharing link tied to their email. It covers the site's root and any lists or libraries that inherit permissions from the site.
What it does not show: unique permissions on specific libraries, folders, or items within the site where inheritance has been broken. If a library has unique permissions configured differently from the site, and the user holds access only at that library level, the site-level Check Permissions result may return no access even though the user can open files within that library. For broken-inheritance scenarios, you need to run Check Permissions separately at the library or item level, or use the tenant-wide report in Method 3.
It also shows results for one site at a time. For a user who may have access across many sites, repeating Check Permissions site by site is impractical at scale.
Method 3: Generate a tenant-wide permissions report
For a tenant-wide view covering group membership, direct grants, and sharing links across all site collections, a permissions export is the only practical option. The built-in SharePoint admin center has no report that lists all sites a named user can access. PnP PowerShell can generate per-site reports but requires scripting and a loop across every site collection to build a tenant-wide picture.
Report Master runs a Permissions Matrix report that returns an Excel file covering every site collection: each row identifies a user or group, their permission level, the source (group, direct, or shared link), and the site and library. To find everything a specific user can access, filter the Excel file by their name or email address. The result shows every permission grant across the tenant in a single workbook.
The permissions export from Report Master includes both internal users and external guests, making it straightforward to filter for guest access during an Entra ID access review or before a security compliance check.
Learn more about Report Master's permissions export
Comparing your options for checking SharePoint user permissions
| Method | Scope | Shows group membership | Shows direct grants | Shows sharing links | Shows library-level access |
|---|---|---|---|---|---|
| SharePoint admin center | Tenant (per site) | Yes | No | No | No |
| Check Permissions (site-level) | One site per check | Yes | Yes | Yes | Partial (site root only) |
| PnP PowerShell | Per-site or scripted tenant | Yes | Yes | Partial | Yes (with additional queries) |
| Report Master | Entire tenant | Yes | Yes | Yes | Yes (all libraries) |
For audits involving fewer than five sites and one or two users, Check Permissions at the site level is fast enough. For routine user offboarding, role changes, or security reviews affecting multiple users across a large tenant, a permissions export is the only approach that gives a complete picture without hours of manual navigation. For the steps to act on permission findings after an audit, see the guide on remediating SharePoint permissions after an audit.
Frequently Asked Questions
Can I see all SharePoint sites a specific user has access to from the admin center?
Not from a single screen. The SharePoint admin center shows site membership per site via the Membership tab, but there is no built-in report that lists all sites a named user can access across the tenant. A permissions export from Report Master or a PnP PowerShell script is required for tenant-wide user access visibility.
What is the difference between a permission level and a sharing link in SharePoint?
A permission level defines what a user can do within a site or library and is assigned through group membership or direct grants. A sharing link is a URL granted to a specific person's email address that gives them access to a file or folder independently of site membership. A user can reach content via sharing links without appearing in the site's membership list at all.
Does removing a user from a SharePoint group revoke their sharing link access too?
No. Group membership removal revokes the access granted by that group, but sharing links tied to the user's email remain active independently. Revoke both to fully remove a user's access. ShareMaster's Shared Links and Permissions tool identifies and bulk-revokes sharing links across the tenant.
How do I check if a guest user has access to SharePoint libraries they should not have?
Run Check Permissions on each site where the guest may have been invited, or generate a tenant-wide permissions export from Report Master and filter by the guest's external email address. The export shows every permission grant and sharing link associated with that address across all site collections in one view.