Knowing who has access to which SharePoint document library is one of the most frequently requested deliverables from a permissions audit. The native SharePoint admin center surfaces permission levels per site, but it cannot produce a cross-library matrix showing every user's access in one exportable report. That gap is where the manual work begins. For a tenant with 80 sites and 300 users, assembling that picture manually is a multi-day task.
What is a SharePoint permissions matrix?
A permissions matrix is a structured report that answers a single question: who has access to what, and at which permission level? Columns typically represent document libraries or sites; rows represent users or security groups. Each cell shows the effective permission level at that intersection - Full Control, Edit, Contribute, Read, or no access.
The output is useful for compliance reviews where an auditor needs a complete access picture, for pre-migration planning where you need to understand which permissions carry over, for offboarding verification where you need to confirm a departing user's access has been fully revoked, and for responding to external audit requests from regulators or clients.
What the native SharePoint admin center shows and what it misses
The SharePoint admin center provides administrators with useful per-site data: the list of site members and their site-level role, external sharing status per site, and storage utilisation. These views are adequate for managing a single site.
What the admin center cannot do: produce a single export showing one user's access footprint across all sites. To determine that a particular user has Edit access on five sites, Read on two others, and no access on the remaining 80, you must open each site individually and check the Permissions page. There is no cross-site query, no export button, and no way to filter by user across the whole tenant.
Microsoft Graph API queries can retrieve this data via PowerShell, but the scripting complexity is significant. SharePoint permission resolution must account for four separate grant sources: directly assigned permissions, SharePoint group membership, Microsoft 365 group membership (which controls access to team sites), and nested Entra ID security group membership. A script that reads only one source produces incomplete results.
Step-by-step: generating the report with Report Master
The steps below use ShareMaster's Report Master. A SharePoint Administrator or Global Administrator account is required.
1 Connect ShareMaster to your tenant
Open ShareMaster and sign in using your SharePoint Administrator credentials. ShareMaster connects to SharePoint Online through Microsoft's supported APIs; no Azure app registration or client secret is required for standard use. The sign-in uses your existing Microsoft account, so MFA flows are supported normally.
If you are running the report for a client tenant as an MSP, you can sign in with delegated admin credentials. The signed-in account determines which site collections are included in the report scope.
2 Open Report Master and define the scope
Navigate to Report Master. Select the scope of sites the report will cover, from a single site collection to all sites the signed-in account can access.
3 Select the Permissions Matrix report type
In the Report Master report type selector, choose Permissions Matrix. Three options configure what the report includes:
- Permission level filter: Include all levels, or limit to Contribute and above. Filtering out Read-only access reduces the size of the output and keeps the focus on users with write permissions, which is typically the higher compliance concern.
- Report depth: Site level only, document library level, or folder level. Library level is the most commonly requested depth. Folder level is appropriate when the site has broken permission inheritance at the folder level and you need to surface those unique-permission scopes.
- Include external users: Enable this when the audit includes a review of external guest access. Guest accounts appear in the output with their external email address, making them easy to filter separately.
4 Export to Excel
Click Export. Report Master enumerates the selected sites, resolves all group memberships (including nested Entra ID security groups and Microsoft 365 group memberships), calculates the effective permission for each user at each location, and writes the results to an Excel workbook.
Run time depends on tenant size and report depth. A 50-site tenant typically completes in under 10 minutes; a 500-site tenant at library-level depth takes 30 to 60 minutes. The export runs in the background, so you can continue using ShareMaster while it processes.
5 Review the output
The Excel workbook opens automatically when the export completes. Apply filters and pivot tables to surface the patterns most relevant to your audit:
- Filter by Permission Level to find every user with Full Control outside the IT team.
- Filter by User Type to isolate guest accounts for a targeted external access review.
- Filter by Inheritance Broken to find all libraries or folders with unique permissions that deviate from the site default.
- Pivot by user to see a single individual's complete access footprint across the entire tenant.
- Pivot by site to identify which sites have the most unique-permission complexity and the widest access surface.
What each column in the output means
| Column | Description | Primary use in an audit |
|---|---|---|
| Site URL | The URL of the site collection. | Filter to a specific site or business unit's site portfolio. |
| Library / Scope | The document library or folder where the permission is applied. | Identify libraries with unique permissions that differ from the parent site. |
| User / Group display name | The display name and UPN of the user, or the name of the SharePoint group or Entra ID group. | Search for a specific person's access footprint across all sites in scope. |
| Permission Level | The assigned SharePoint permission level: Full Control, Edit, Contribute, Read, or a custom level name. | Filter to Contribute and above for a write-access review; filter to Full Control for a privileged-access review. |
| Permission Source | How the permission was granted: directly assigned, via SharePoint group, via Microsoft 365 group, or via Entra ID security group. | Distinguish access grants that can be removed individually from those that require group membership changes. |
| User Type | Internal, Guest, or Service Account. | Isolate external access. Guest accounts carry higher compliance risk and warrant separate review. |
| Inheritance Broken | Boolean flag indicating whether unique permissions are active at this scope. | Find all locations where someone has manually applied custom permissions that override the site default. |
Next steps: acting on what the report reveals
The matrix is diagnostic. The audit value comes from what you do with the findings. Three common remediation actions:
- Revoke over-broad access. Users with Full Control on sites they do not administer, or Contribute access where they only need to read, are common findings in tenants that have grown organically. Reduce these via SharePoint group membership changes or by removing the direct permission grant.
- Restore inheritance on libraries with unjustified unique permissions. If a library has broken inheritance and the reason is unclear or no longer valid, restoring inheritance reduces administrative overhead and closes an access control gap.
- Remove stale external access. Guest accounts with active permissions but no recent activity are a security exposure. Remove their permissions and, where appropriate, raise a formal Entra ID access review through Microsoft Purview or the Microsoft 365 admin center.
For a structured walkthrough of the remediation process, see How to Remediate SharePoint Permissions After an Audit. For the broader audit that typically precedes generating this report, see How to Audit SharePoint Permissions.
Frequently Asked Questions
What is a SharePoint permissions matrix?
A permissions matrix is a structured report showing every user's access level across every document library or site in scope, in a single tabular output. It answers the question: who has access to what, and at which permission level? The report is typically exported to Excel and used for compliance reviews, access audits, and pre-migration planning.
Can I generate a permissions matrix from the SharePoint admin center?
The SharePoint admin center shows permissions per site but cannot produce a cross-site or cross-library matrix in one export. An equivalent report produced natively requires combining Microsoft Entra ID data, SharePoint audit logs, and manual assembly, or writing Microsoft Graph API queries via PowerShell to resolve group memberships and unique permissions.
Does the report include external guest users?
Yes. Report Master resolves Entra ID guest accounts and includes them in the matrix alongside internal users. Guest accounts are identifiable by their external email address format and appear under the Guest user type filter.
What Microsoft 365 role do I need?
Report Master requires a SharePoint Administrator or Global Administrator account to query permissions across site collections. A site owner account can run a scoped report for sites they own, but cannot access other sites in the tenant.