How do I find out what kind of access a user has to a SharePoint Online site using PNP PowerShell?

Question

In Powershell, after running the Connect-PnPOnline -Url https://yourtenant.sharepoint.com/sites/xyz -UseWebLogin and Get-PnPUser -WithRightsAssigned commands, I can get the list of all users that have any kind of access to a specific SharePoint Online site.

But using PnP powershell, how do I find out what kind of access they have? i.e. : Read, Contribute, etc?

Answer 1

Please try below script, this will give list of users who have direct access to the site:

# Import the PnP PowerShell module
Import-Module PnP.PowerShell

# Connect to SharePoint Online
Connect-PnPOnline -Url "https://<site-collection-url>" -UseWebLogin

# Get the web object with role assignments included
$web = Get-PnPWeb -Includes RoleAssignments

# Get users with rights assigned
$users = Get-PnPUser -WithRightsAssigned

foreach ($user in $users) {
    # Get role assignments for the user
    $roleAssignments = $web.RoleAssignments | Where-Object { $_.Member.LoginName -eq $user.LoginName }
    foreach ($roleAssignment in $roleAssignments) {
        $roleDefinitionBindings = $roleAssignment.RoleDefinitionBindings
        foreach ($roleDefinition in $roleDefinitionBindings) {
            Write-Output "$($user.LoginName) has the following role: $($roleDefinition.Name)"
        }
    }
}

Output:

---

Here, I have one nice reference for the full site permission report: https://www.sharepointdiary.com/2018/09/sharepoint-online-site-collection-permission-report-using-powershell.html