How to Get a SharePoint Online Permissions Report with PowerShell or Netwrix Auditor

Your SharePoint Online environment is critical for your business: Employees rely on it every day to collaborate and share information with colleagues, partners and customers, and perhaps even to promote and sell products. 

But although SharePoint Online is easy for everyone to use, it’s not simple at all to administer and secure. Each site can have its own users, groups, permissions, themes, schemas, workflows and policies. This complexity makes it hard to understand and control access rights. That’s a problem, since many organizations use SharePoint Online to process, share and store various types of sensitive and regulated data — from personally identifiable information (PII) to intellectual property (IP) to financial data — all of which must be properly protected to maintain security and ensure regulatory compliance.

If you want to check what permissions a certain user has on a particular site, you can simply use the Check Permissions button in the Site Permissions subsection of Site Settings. However, if you need to know the access permissions for all users, this manual method is not a viable approach. 

Therefore, when you need to get a comprehensive SharePoint Online permissions report, PowerShell is the best native option. However, there is no out-of-the-box cmdlet for getting user or object permissions, so you’ll have to write a script. Sample scripts available online suggest usingaclient-side object model (CSOM), so you’ll have to download and install the SharePoint Online Client Components SDK on your server, add a new SharePoint object type with the correct dll path, and then crawl through your site’s structure. That will take significant time — and solid PowerShell scripting skills. 

Netwrix Auditor empowers you to easily see through the complicated permissions of SharePoint Online and clearly see which users have what permissions to what files. You can get the picture of your permissions structure in just few clicks; just run a pre-defined report that shows who has access to what, the level of permissions they have and how those permissions were granted