What it works with
Module: PnP.PowerShell
Context: PowerShell 7.4+ · SharePoint Online · PnP.PowerShell
Compatibility: PowerShell 7.4+ is required by current PnP.PowerShell releases.
POWERSHELL / SHAREPOINT
ProAdvancedRead-onlyLow
Deep SharePoint permissions report
Builds a configurable SharePoint permissions report for selected sites with explicit site, list/library and bounded item-level depth.
Pro generation after license validation · Review before running · No tenant access
What this PowerShell script does
Builds a configurable SharePoint permissions report for selected sites with explicit site, list/library and bounded item-level depth.
Requirements
- Scope - Audit one SharePoint site or URLs supplied in a CSV with a SiteUrl column.
- SharePoint site URL - Required when Scope is Single site.
- Site list CSV path - CSV must contain a SiteUrl column. Duplicate URLs are ignored.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- Audit depth - Item depth is intentionally opt-in because it can require many SharePoint calls.
- Maximum items per list/library - Hard upper bound per list/library when item depth is selected.
- Include hidden lists/libraries - Hidden system lists are excluded by default.
- CSV output path - Use a new absolute Windows CSV path. Existing files are not overwritten.
Environment
- Module: PnP.PowerShell
- Runtime: PowerShell 7.4+
- Authentication: Interactive PnP with your own client ID/default
- Permissions: SharePoint AllSites.Read delegated access plus sufficient site permissions to enumerate role assignments at the selected depth.
- Risk: Low
Review before you runReview the generated PowerShell and scope before running it.
OPS / WORKSPACE
Ready to generate
Configure Deep SharePoint permissions report in the Builder, review the generated PowerShell and run it in your own environment.
When to use this template
Use this report when you need principals and role definitions on selected SharePoint permission scopes. Start shallow and enable item depth only for a targeted investigation.
Important limitations
- Item-level depth can be expensive even with a hard cap and should be used only when needed.
- Direct role assignments are reported; nested Entra/Microsoft 365 group membership is not recursively expanded.
- A permission assignment being unique does not by itself mean it is wrong or insecure.
- Subsites are not discovered recursively in this first version; provide each web/site scope that must be audited.
PowerShell and PnP requirements
Current PnP.PowerShell releases require PowerShell 7.4 or later. Interactive authentication requires your own Entra application/client ID, or a configured PnP default client ID. This script is read-only and does not intentionally change SharePoint configuration.
Opselith does not connect to your tenant or execute the script on your behalf. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation. Template source remains server-side.
Generate the script
- Open this template in the PowerShell Builder.
- Enter the required scope, safety and output values.
- Generate and review the PowerShell before running it in your own environment.
OPS / SCRIPT DETAILS
Script details
Builds a configurable SharePoint permissions report for selected sites with explicit site, list/library and bounded item-level depth. Review these details before generating or running the script.
Permissions and impact
Permissions: AllSites.Read · Site Owner / Site Collection Administrator
Risk: Low
Execution impact: Read-only. Reads SharePoint securable-object role assignments. Item-level depth is opt-in and bounded; no permissions are changed.
Parameters
- Scope - Audit one SharePoint site or URLs supplied in a CSV with a SiteUrl column.
- SharePoint site URL - Required when Scope is Single site.
- Site list CSV path - CSV must contain a SiteUrl column. Duplicate URLs are ignored.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- Audit depth - Item depth is intentionally opt-in because it can require many SharePoint calls.
- Maximum items per list/library - Hard upper bound per list/library when item depth is selected.
- Include hidden lists/libraries - Hidden system lists are excluded by default.
- CSV output path - Use a new absolute Windows CSV path. Existing files are not overwritten.
Output
Output: CSV permissions report with SiteUrl, ObjectType, ObjectUrl, ObjectTitle, HasUniquePermissions, Principal, PrincipalType, RoleDefinitions, InheritedFrom, ScanStatus and Error.
This template is part of the Pro library. The full Pro script is generated by Opselith after server-side license validation; only the configuration values needed by this template are sent for generation. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation.
Example use
Builds a configurable SharePoint permissions report for selected sites with explicit site, list/library and bounded item-level depth.
Enter the required values in the Builder, review the generated script and confirm the output before running it.
Before you run: Use PowerShell 7.4+ with PnP.PowerShell. Start with site/list-library depth, use item depth only for a targeted review, and choose a conservative item cap.
Opselith quality checks
- Included in the current Opselith PowerShell quality suite
- Deep item scanning is never the default
- Hard per-container item cap
- No recursive directory-group expansion
- Per-object failures are isolated
- No permission changes
Was this useful?One click. No email.