0

I am having trouble with what I thought would be a very simple task, and I was hoping to ask for any assistance.

I have a task to very simply collect a list of all users that have any level of access to a SharePoint site, whether they are visitors, members, part of a group that is part of the members etc. I just need a list of everyone that can access a SharePoint site in any manner.

Get-SPOUser seems pretty straightforward, and I do get results back with simply: Get-SPOUser -Site -Limit ALL

However, what is puzzling me is the list is initially incomplete. If I compare the output of the above with what I see in the SharePoint GUI, it is very incomplete.

If I go into SharePoint site permissions > Advanced Permission and select "Check Permissions" and input one of the users that was missing from the PowerShell output, it of course returns output telling me that the user has permissions to the site.

And this last part absolutely baffles me. After I check in the GUI, if I run Get-SPOUser again, that single missing user then pops up.

I don't know if this is a bug or what, but I am just looking for any assistance on what I thought was a simple task of "Get a list of users that has access to this site."

Thank you very much for any assistance given.

1 Answer 1

0

You could try below PNP PowerShell.

$siteURL = "https://tenant.sharepoint.com/sites/emilytestnew"
$path = "C:\sitepermission.csv"
 
#Connect to Site
Connect-PnPonline -Url $siteURL -Interactive
 
#Get the web
$web = Get-PnPWeb -Includes RoleAssignments
 
#Loop through each permission assigned and extract details
$permissionData = @()
ForEach ($roleAssignment in $web.RoleAssignments)
{
    #Get the Permission Levels assigned and Member
    Get-PnPProperty -ClientObject $roleAssignment -Property RoleDefinitionBindings, Member
     
    #Get the Permission Levels assigned
    $permissionLevels = ($roleAssignment.RoleDefinitionBindings | Select -ExpandProperty Name | Where { $_ -ne "Limited Access"} ) -join ","
     
    #Leave Principals with no Permissions
    If($permissionLevels.Length -eq 0) {Continue}
 
    $permissionType = $roleAssignment.Member.PrincipalType
    #Get SharePoint group members
    If($permissionType -eq "SharePointGroup")
    {
        #Get Group Members
        $groupMembers = Get-PnPGroupMember -Identity $roleAssignment.Member.LoginName
                   
        #Leave Empty Groups
        If($groupMembers.count -eq 0){ Continue }
        $groupUsers = ($groupMembers | Select -ExpandProperty LoginName | Where { $_ -ne "SHAREPOINT\system"}) -join "; "
   
        #Add the Data to Object
        $permissions = New-Object PSObject
        $permissions | Add-Member NoteProperty Name($roleAssignment.Member.Title)
        $permissions | Add-Member NoteProperty Accounts($groupUsers)
        $permissions | Add-Member NoteProperty Type($permissionType)
        $permissions | Add-Member NoteProperty PermissionLevels($permissionLevels)
        $permissionData += $permissions
    }
    Else
    {
        #Add the Data to Object
        $permissions = New-Object PSObject
        $permissions | Add-Member NoteProperty Name($roleAssignment.Member.Title)
        $permissions | Add-Member NoteProperty Accounts($roleAssignment.Member.LoginName)
        $permissions | Add-Member NoteProperty Type($permissionType)
        $permissions | Add-Member NoteProperty PermissionLevels($permissionLevels)
        $permissionData += $permissions
    }
} 
#Export Permissions data to CSV file
$permissionData | Export-Csv $path
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.