How to export site permissions in SharePoint Online

Before you start

Use an account with the SharePoint Administrator role. Microsoft says Get-SPOSiteGroup needs an account that's a SharePoint administrator and a site collection administrator of the site, so the script lists a site where you aren't one as not read. In PowerShell 7 the SharePoint Online Management Shell loads through Windows PowerShell, which the last line of the install block does.

The groups are read live, 1 site at a time, so the script is slow on a large tenant. OneDrives are left out. A member can be a Microsoft Entra group rather than a person, and its own members aren't listed. The examples read and export and change nothing.

Option 1

Export site permissions with PowerShell

Install the module once, then connect and read each site's groups. The connection prompts you to sign in. Replace contoso with your tenant's name.

# Install once, if the module is not already installed.
Install-Module Microsoft.Online.SharePoint.PowerShell -Scope CurrentUser
# In PowerShell 7 only: load the module through Windows PowerShell.
Import-Module Microsoft.Online.SharePoint.PowerShell -UseWindowsPowerShell

$ErrorActionPreference = 'Stop'
Connect-SPOService -Url 'https://contoso-admin.sharepoint.com'
try {
    $rows = [System.Collections.Generic.List[object]]::new()
    foreach ($site in Get-SPOSite -Limit All) {
        try {
            $groups = @(Get-SPOSiteGroup -Site $site.Url -Limit 1000)
        } catch {
            $rows.Add([pscustomobject]@{ Url = $site.Url; Group = 'Not read'; Levels = ''
                Member = "$_" })
            continue
        }
        foreach ($group in $groups) {
            $levels = @($group.Roles) -join '; '
            $members = @($group.Users)
            if ($members.Count -eq 0) { $members = @('(no members)') }
            foreach ($member in $members) {
                $rows.Add([pscustomobject]@{ Url = $site.Url; Group = $group.Title
                    Levels = $levels; Member = $member })
            }
        }
    }
    if ($rows.Count -eq 0) {
        Write-Output 'No site groups were found.'
    } else {
        $rows | Sort-Object Url, Group, Member |
            Export-Csv -Path './site-permissions.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) rows written to site-permissions.csv."
    }
} finally {
    Disconnect-SPOService
}

Each row names a site, 1 of its groups, the group's permission levels and 1 member by login name; a group with no members has 1 row saying so, and a site you couldn't read has Not read and the error instead. A group with no permission level reaches nothing on the site, so check Levels before you act. To read 1 site, replace Get-SPOSite -Limit All with Get-SPOSite -Identity and its address.

Option 2

Check a site's permissions from the admin centre

1. Sign in to Active sites in the SharePoint admin centre as a SharePoint Administrator.
2. Select the site, then select Membership on the command bar to open the details panel.
3. Read each tab: Site admins, Site owners, Site members and Site visitors, and on a site connected to a Microsoft 365 group, its Owners and Members.
4. Close the panel without adding or removing anyone, so nothing changes.

This suits checking 1 site. The panel shows the site's admins and its owners, members and visitors, not other site groups or people granted access directly; for those, open the site's own permissions as a site admin of that site. Every site means opening each in turn. With SharePoint Advanced Management, the site permissions report under Reports > Data access governance counts the users, groups and items with unique permissions on every site, though not who they are.

Common questions

Why can someone open a file when they aren't in the export?

They may have been given access to the file, its folder or its library alone, or through a sharing link. Those permissions sit below the site, so a list of the site's groups doesn't show them.

Are the site's administrators in the export?

Not necessarily. The script reads the site's groups, so it lists an administrator only when they're also in one. See how to list site administrators in SharePoint Online.

Why is the whole organisation in a visitors group?

A site group can hold Everyone except external users, which stands for every person in the organisation. That makes the site open to all of them, whatever its own membership says.