When a user leaves a project, changes roles, or triggers a security alert, you need to know exactly what SharePoint sites and libraries they can access. SharePoint Online has no single screen that answers this question. Access comes from three separate sources: site group membership, direct permission grants, and sharing links. Finding all three requires knowing where to look.
What "user permission" means in SharePoint Online
In SharePoint Online, a user's effective access to content is determined by the combination of three independent mechanisms. Permission levels (Read, Contribute, Edit, Full Control) define what a user can do within a site or library. These can be assigned through site group membership or as direct grants to an individual at the site, library, folder, or item level. Sharing links are a third, separate mechanism: a URL granted to a specific person's email address, giving them access to a file or folder independently of whether they are a member of the site.
Understanding this distinction matters because removing a user from a SharePoint site group does not revoke their sharing link access. The two sources of access must be reviewed and removed separately. A user with no group membership can still have access to dozens of files across a site via sharing links that were created months or years earlier.
Method 1: Check permissions via the SharePoint admin center
The SharePoint admin center gives you a tenant-wide view of site collections and their membership. To check a specific user's site-level access:
- Sign in to the Microsoft 365 admin center and navigate to Admin centers > SharePoint.
- In the SharePoint admin center, select Active sites from the left navigation.
- Find the site you want to check. Use the search bar at the top of the list to filter by site name or URL.
- Click the site name to open the detail panel on the right side of the screen.
- Select the Membership tab in the detail panel. This lists site owners, members, and visitors by their group roles.
- Search within the membership tab or scroll to find the user. Their presence here confirms they have site-level group membership access.
This method works well for confirming whether a user is a member of a given site. Its limitation: it shows group membership only, not direct permission grants at the library or item level, and not sharing links. For a complete picture, use Method 2 or Method 3 below.
Method 2: Use the site-level Check Permissions feature
Where to find Check Permissions on a SharePoint site
SharePoint Online includes a built-in Check Permissions tool on every site that shows a specific user's effective access. To access it:
- Navigate directly to the SharePoint site in a web browser. You must be a site owner or site collection administrator to use this feature.
- Click the gear icon (Settings) at the top right of the site and choose Site permissions.
- In the Site permissions panel, look for the Advanced permissions settings link at the bottom of the panel. Click it. This opens the classic site permissions page.
- On the classic permissions page, click Check Permissions in the ribbon at the top.
- In the dialog that appears, enter the user's name or email address. Click Check Now.
- SharePoint returns a list of permission levels the user holds on the site, along with the source of each one (the site group that grants it, or a direct grant). A Limited Access entry means they can reach something inside the site, such as a shared file or a library with unique permissions.
What Check Permissions shows and what it misses
Check Permissions shows the user's effective permission level on the site itself and reveals whether the access came from a group or a direct grant. It covers the site's root and any lists or libraries that inherit permissions from the site.
What it does not show: unique permissions on specific libraries, folders, or items within the site where inheritance has been broken. If a library has unique permissions configured differently from the site, and the user holds access only at that library level, the site-level Check Permissions result shows only Limited Access, which tells you something inside the site is open to them but not what. Sharing links show up the same way. For broken-inheritance scenarios, you need to run Check Permissions separately at the library or item level, or use the report in Method 3.
It also shows results for one site at a time. For a user who may have access across many sites, repeating Check Permissions site by site is impractical at scale.
Method 3: Generate a permissions report for each site
For a view covering group membership, direct grants, and sharing links down to item level, a permissions export is the only practical option. The built-in SharePoint admin center has no report that lists all sites a named user can access. PnP PowerShell can generate per-site reports but requires scripting and a loop across every site collection to build a tenant-wide picture.
Report Master (the Reports menu in the app) includes a Security Matrix report. You connect to a site, pick its lists and libraries, and it returns an Excel workbook with sheets for the site's permissions, its SharePoint groups and their members, sharing links, and each item with unique permissions, plus Microsoft 365 group membership when Microsoft Graph consent is in place. It needs site collection administrator access and runs one site at a time. To find everything a specific user can access, search each workbook for their name or email address.
The Security Matrix lists internal users and external guests alike, making it straightforward to search for guest access during an Entra ID access review or before a security compliance check.
Learn more about Report Master's permissions export
Comparing your options for checking SharePoint user permissions
| Method | Scope | Shows group membership | Shows direct grants | Shows sharing links | Shows library-level access |
|---|---|---|---|---|---|
| SharePoint admin center | Tenant (per site) | Yes | No | No | No |
| Check Permissions (site-level) | One site per check | Yes | Yes | Partial (as Limited Access) | Partial (site root only) |
| PnP PowerShell | Per-site or scripted tenant | Yes | Yes | Partial | Yes (with additional queries) |
| Report Master (Security Matrix) | One site per report | Yes | Yes | Yes | Yes (libraries you pick) |
For audits involving fewer than five sites and one or two users, Check Permissions at the site level is fast enough. For routine user offboarding, role changes, or security reviews affecting multiple users, a permissions export per site is the only approach that gives a complete picture without hours of manual navigation. For the steps to act on permission findings after an audit, see the guide on remediating SharePoint permissions after an audit.
Frequently Asked Questions
Can I see all SharePoint sites a specific user has access to from the admin center?
Not from a single screen. The SharePoint admin center shows site membership per site via the Membership tab, but there is no built-in report that lists all sites a named user can access across the tenant. Building that picture means a PnP PowerShell script looped over every site, or a permissions report per site such as ShareMaster's Security Matrix.
What is the difference between a permission level and a sharing link in SharePoint?
A permission level defines what a user can do within a site or library and is assigned through group membership or direct grants. A sharing link is a URL granted to a specific person's email address that gives them access to a file or folder independently of site membership. A user can reach content via sharing links without appearing in the site's membership list at all.
Does removing a user from a SharePoint group revoke their sharing link access too?
No. Group membership removal revokes the access granted by that group, but sharing links tied to the user's email remain active independently. Revoke both to fully remove a user's access. ShareMaster's Share Link Finder reports the sharing links in the libraries you pick on a site and, on a paid licence, removes them in bulk.
How do I check if a guest user has access to SharePoint libraries they should not have?
Run Check Permissions on each site where the guest may have been invited, or run a Security Matrix report on those sites and search each workbook for the guest's external email address. It lists the site permissions, group memberships, sharing links and unique item permissions that name that address on each site you report on.