Is there an easy method in a SharePoint 2013 Online or on-premise instance to quickly identify all sites and libraries with direct permissions? I'm trying to enforce groups wherever I can but site owners continue to add permissions directly. Hoping to find a way I can monitor this to help curb the behaviour.

  • Are you sure they're not using the Sharing functionality? In order to monitor inheritance, you'd have to enumerate each object in the farm. That is computationally expensive.
    – Trevor Seward
    Apr 6 '18 at 1:53
  • Yes, most definitely. But I think it's worthwhile at least initially to identify issues?
    – Michael A
    Apr 6 '18 at 2:22
  • If they use Share, they will be adding individual permissions on a Document, List/Library, or Site. In my opinion, you're attempting to fight a futile battle as long as you leave Share on.
    – Trevor Seward
    Apr 6 '18 at 2:24
  • Ah - sorry. Not referring to Share, just got what you mean. I'm referring to when people in other business units are added directly to site permissions by site owners..
    – Michael A
    Apr 6 '18 at 3:00

SharePoint comes with Auditing feature, which helps in identifying all such activities. You need to configure auditing in your environment. If you had already configured Audit for site collection you can follow follow the below steps.

  1. Click on gear icon, and select Site Settings from the drop down menu.
  2. Now under site collection administrator section, find Audit Log Reports. Click on it, it will open a page.
  3. Now under Security and Site Settings Report select Security Settings.
  4. Follow the on screen instruction to fill the location of report. Hit Ok and you are done.

The report will be available in destination library you selected. The report will contain information regarding, permission on site and specific list and lib. Also it will show the data like who added/deleted/modified permission and when.

To configure audit logs follow below steps:

  1. Click on gear icon and select Site Settings.
  2. Under site collection administrator section find Site collection audit settings. Click on it will open a page.
  3. In setting page, configure log trimming (if you want) this will remove past log data specified in numbers. Under List, Library and Site check the Editing users and permissions. This will start logging permission data.

Follow the URL to learn more on Auditing. https://support.office.com/en-us/article/configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2

This is a good way to check Site collection wise.

If you are looking for entire farm, then you night need to consider writing some PowerShell code in order to get the data from all site collection/web applications.

  • Are there any examples of any such powershell out there?
    – Michael A
    Apr 6 '18 at 4:36
  • Hi, I found a solution on technet forum. Get-SPWeb YOURURL | Get-SPUserEffectivePermissions $user | Export-Csv -NoTypeInformation -Path c:\perms.csv. Currently i am not having SP Farm environment, otherwise i would have included that solution as well. Apr 6 '18 at 19:08
  • Also there is a similar question here sharepoint.stackexchange.com/questions/144110/… Apr 6 '18 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.