I have a company SharePoint Online portal (https://company.sharepoint.com) containing a number of sub-sites - some of them with sub-sub-sites. How can I get a list that shows all users on the portal with (sub-)sub-sites each user has access to (plus, the type of access rights, preferably)? Thank you.

4 Answers 4


A simple way: use SharePoint Online PnP Module via PowerShell.

Reference: https://gallery.technet.microsoft.com/office/Get-SharePoint-Online-and-7e6afce2


Using powershell, try this script:

Import-Module 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.dll'
Import-Module 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.Runtime.dll'
Import-Module 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.Publishing.dll'

$url ="<your site URL>"
$context = New-Object Microsoft.SharePoint.Client.ClientContext($url)

$userCollection = $context.Web.SiteUsers

        foreach ($user in $userCollection)
            $userName = $user.LoginName
            Add-Content -Path C:\logs.log -Value $userName
            Add-Content -Path C:\logs.log -Value "-----------------------------------"
            $permissions = $context.Web.GetUserEffectivePermissions($user.LoginName)
            $PermissionKindObj=New-Object Microsoft.SharePoint.Client.PermissionKind

            foreach ($permissionKind in [System.Enum]::GetValues($PermissionKindType))
                $permisson = [System.Enum]::GetName($type, $permissionKind)
                $hasPermisssion = $permissions.Value.Has($permissionKind);
                if ($hasPermisssion)
                    Add-Content -Path C:\logs.log -Value $permissionKind.ToString()                    



If you already have ShareGate inhouse then it is one of the default reports available. Otherwise get the free 14 days trial if you just need a snapshot right now


This writes to a .csv

foreach ($site in  ($sites = Get-SPOSite -limit All)) {
$users = Get-SPOUser -Site $site
foreach ($user in $users){
    $data = [PSCustomObject]@{
        "Site Url" = $site.url
        "User Login" = $user.loginname
        "Groups" = $user.Groups
        "User Type" = $user.usertype
$data | Export-Csv -Append -NoTypeInformation c:\temp\spo-output.csv 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.