Is there a powershell script for SharePoint online that can create a csv report listing permission/access details for all users of a SharePoint site? We have licenses to Offices 365 E3 which includes SharePoint online and would like to list the sites, sub-sites, site collections that all of our users have access to and their roles. I am aware of limitations of Sharepoint Online comparing to on-premise but would like to know if this type of report is possible to create?

  • An alternativ to build-it-inhouse could be to have a look at what ShareGate og Metalogics offers. I have often shown IT pros and support staff how to use ShareGate to pinpoint access related issues – Kasper Bo Larsen May 6 '18 at 17:36

You can use this Powershell to get all users permission detials:

Import-Module 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.dll'
Import-Module 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.Runtime.dll'
Import-Module 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.Publishing.dll'

$url ="<your site URL>"
$context = New-Object Microsoft.SharePoint.Client.ClientContext($url)

$userCollection = $context.Web.SiteUsers

        foreach ($user in $userCollection)
            $userName = $user.LoginName
            Add-Content -Path C:\logs.log -Value $userName
            Add-Content -Path C:\logs.log -Value "-----------------------------------"
            $permissions = $context.Web.GetUserEffectivePermissions($user.LoginName)
            $PermissionKindObj=New-Object Microsoft.SharePoint.Client.PermissionKind

            foreach ($permissionKind in [System.Enum]::GetValues($PermissionKindType))
                $permisson = [System.Enum]::GetName($type, $permissionKind)
                $hasPermisssion = $permissions.Value.Has($permissionKind);
                if ($hasPermisssion)
                    Add-Content -Path C:\logs.log -Value $permissionKind.ToString()                    

You can check the user permission in C:\logs, you can change the path. If you don't have the Microsoft.SharePoint.Client.dll, you can download it from internet. This is a client side code, so you can use it in SharePoint online.


Here is one I made that writes to a .csv

foreach ($site in  ($sites = Get-SPOSite -limit All)) {
$users = Get-SPOUser -Site $site
foreach ($user in $users){
    $data = [PSCustomObject]@{
        "Site Url" = $site.url
        "User Login" = $user.loginname
        "Groups" = $user.Groups
        "User Type" = $user.usertype
$data | Export-Csv -Append -NoTypeInformation c:\temp\spo-output.csv 

protected by Community May 10 at 13:06

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.