Sharepoint Online All User Access/Permissions Report

Question

Is there a powershell script for SharePoint online that can create a csv report listing permission/access details for all users of a SharePoint site? We have licenses to Offices 365 E3 which includes SharePoint online and would like to list the sites, sub-sites, site collections that all of our users have access to and their roles. I am aware of limitations of Sharepoint Online comparing to on-premise but would like to know if this type of report is possible to create?

Answer 1

You can use this Powershell to get all users permission detials:

Import-Module 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.dll'
Import-Module 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.Runtime.dll'
Import-Module 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.Publishing.dll'

$url ="<your site URL>"
$context = New-Object Microsoft.SharePoint.Client.ClientContext($url)

$userCollection = $context.Web.SiteUsers
        $context.Load($userCollection)
        $context.ExecuteQuery()

        foreach ($user in $userCollection)
        {
            $userName = $user.LoginName
            Add-Content -Path C:\logs.log -Value $userName
            Add-Content -Path C:\logs.log -Value "-----------------------------------"
            $permissions = $context.Web.GetUserEffectivePermissions($user.LoginName)
            $context.ExecuteQuery()
            $PermissionKindObj=New-Object Microsoft.SharePoint.Client.PermissionKind
            $PermissionKindType=$PermissionKindObj.getType()

            foreach ($permissionKind in [System.Enum]::GetValues($PermissionKindType))
            {
                $type=$permissionKind.getType()
                $permisson = [System.Enum]::GetName($type, $permissionKind)
                $hasPermisssion = $permissions.Value.Has($permissionKind);
                if ($hasPermisssion)
                {
                    Add-Content -Path C:\logs.log -Value $permissionKind.ToString()                    
                }
            }
        }

You can check the user permission in C:\logs, you can change the path. If you don't have the Microsoft.SharePoint.Client.dll, you can download it from internet. This is a client side code, so you can use it in SharePoint online.

Answer 2

Here is one I made that writes to a .csv

foreach ($site in  ($sites = Get-SPOSite -limit All)) {
$users = Get-SPOUser -Site $site
foreach ($user in $users){
    $data = [PSCustomObject]@{
        "Site Url" = $site.url
        "User Login" = $user.loginname
        "Groups" = $user.Groups
        "User Type" = $user.usertype
    }
$data | Export-Csv -Append -NoTypeInformation c:\temp\spo-output.csv 
}
}