Is there a powershell script for SharePoint online that can create a csv report listing permission/access details for all users of a SharePoint site? We have licenses to Offices 365 E3 which includes SharePoint online and would like to list the sites, sub-sites, site collections that all of our users have access to and their roles. I am aware of limitations of Sharepoint Online comparing to on-premise but would like to know if this type of report is possible to create?

  • An alternativ to build-it-inhouse could be to have a look at what ShareGate og Metalogics offers. I have often shown IT pros and support staff how to use ShareGate to pinpoint access related issues Commented May 6, 2018 at 17:36

2 Answers 2


You can use this Powershell to get all users permission detials:

Import-Module 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.dll'
Import-Module 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.Runtime.dll'
Import-Module 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.Publishing.dll'

$url ="<your site URL>"
$context = New-Object Microsoft.SharePoint.Client.ClientContext($url)

$userCollection = $context.Web.SiteUsers

        foreach ($user in $userCollection)
            $userName = $user.LoginName
            Add-Content -Path C:\logs.log -Value $userName
            Add-Content -Path C:\logs.log -Value "-----------------------------------"
            $permissions = $context.Web.GetUserEffectivePermissions($user.LoginName)
            $PermissionKindObj=New-Object Microsoft.SharePoint.Client.PermissionKind

            foreach ($permissionKind in [System.Enum]::GetValues($PermissionKindType))
                $permisson = [System.Enum]::GetName($type, $permissionKind)
                $hasPermisssion = $permissions.Value.Has($permissionKind);
                if ($hasPermisssion)
                    Add-Content -Path C:\logs.log -Value $permissionKind.ToString()                    

You can check the user permission in C:\logs, you can change the path. If you don't have the Microsoft.SharePoint.Client.dll, you can download it from internet. This is a client side code, so you can use it in SharePoint online.


Here is one I made that writes to a .csv

foreach ($site in  ($sites = Get-SPOSite -limit All)) {
$users = Get-SPOUser -Site $site
foreach ($user in $users){
    $data = [PSCustomObject]@{
        "Site Url" = $site.url
        "User Login" = $user.loginname
        "Groups" = $user.Groups
        "User Type" = $user.usertype
$data | Export-Csv -Append -NoTypeInformation c:\temp\spo-output.csv 

Not the answer you're looking for? Browse other questions tagged or ask your own question.