What it works with
Module: PnP.PowerShell
Context: PowerShell 7.4+ · SharePoint Online · PnP.PowerShell
Compatibility: PowerShell 7.4+ is required by current PnP.PowerShell releases.
POWERSHELL / SHAREPOINT
ProAdvancedRead-onlyLow
Find broken SharePoint permission inheritance
Finds lists, libraries and optionally bounded items that have unique SharePoint permissions without expanding every principal and role assignment.
Pro generation after license validation · Review before running · No tenant access
What this PowerShell script does
Finds lists, libraries and optionally bounded items that have unique SharePoint permissions without expanding every principal and role assignment.
Requirements
- SharePoint site URL - Site to scan for unique permission scopes.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- Scan depth - Item-level scanning is opt-in because it is substantially more expensive.
- Maximum items per list/library - Hard upper bound for item-level inspection.
- Include hidden lists/libraries - Hidden system lists are excluded by default.
- CSV output path - Use a new absolute Windows CSV path. Existing files are not overwritten.
Environment
- Module: PnP.PowerShell
- Runtime: PowerShell 7.4+
- Authentication: Interactive PnP with your own client ID/default
- Permissions: SharePoint AllSites.Read delegated access plus sufficient read access to inspect permission inheritance on the selected site.
- Risk: Low
Review before you runReview the generated PowerShell and scope before running it.
OPS / WORKSPACE
Ready to generate
Configure Find broken SharePoint permission inheritance in the Builder, review the generated PowerShell and run it in your own environment.
When to use this template
Use this finder to locate unique permission scopes without expanding every principal and role assignment.
Important limitations
- A unique permission scope is a review signal, not proof of a misconfiguration.
- The root web is not reported as a broken-inheritance finding because it is the permission baseline for this scan.
- Item-level scanning is bounded and can stop before every item has been inspected.
- Principal/role expansion is intentionally excluded; use the deep permissions report for that.
PowerShell and PnP requirements
Current PnP.PowerShell releases require PowerShell 7.4 or later. Interactive authentication requires your own Entra application/client ID, or a configured PnP default client ID. This script is read-only and does not intentionally change SharePoint configuration.
Opselith does not connect to your tenant or execute the script on your behalf. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation. Template source remains server-side.
Generate the script
- Open this template in the PowerShell Builder.
- Enter the required scope, safety and output values.
- Generate and review the PowerShell before running it in your own environment.
OPS / SCRIPT DETAILS
Script details
Finds lists, libraries and optionally bounded items that have unique SharePoint permissions without expanding every principal and role assignment. Review these details before generating or running the script.
Permissions and impact
Permissions: AllSites.Read · Site Owner / Site Collection Administrator
Risk: Low
Execution impact: Read-only. Reads HasUniqueRoleAssignments metadata and never changes inheritance or permissions.
Parameters
- SharePoint site URL - Site to scan for unique permission scopes.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- Scan depth - Item-level scanning is opt-in because it is substantially more expensive.
- Maximum items per list/library - Hard upper bound for item-level inspection.
- Include hidden lists/libraries - Hidden system lists are excluded by default.
- CSV output path - Use a new absolute Windows CSV path. Existing files are not overwritten.
Output
Output: CSV inheritance report with SiteUrl, ObjectType, ObjectUrl, ObjectTitle, HasUniqueRoleAssignments, ParentUrl, ScanStatus and Error.
This template is part of the Pro library. The full Pro script is generated by Opselith after server-side license validation; only the configuration values needed by this template are sent for generation. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation.
Example use
Finds lists, libraries and optionally bounded items that have unique SharePoint permissions without expanding every principal and role assignment.
Enter the required values in the Builder, review the generated script and confirm the output before running it.
Before you run: Use PowerShell 7.4+ with PnP.PowerShell. Begin with list/library depth and enable item scanning only for a targeted investigation.
Opselith quality checks
- Included in the current Opselith PowerShell quality suite
- List/library metadata is the default
- Item scanning requires explicit opt-in and a hard cap
- No principal/role expansion
- No permission mutation
- Limit-reached rows make incomplete scans explicit
Was this useful?One click. No email.