Blog written by:
Liam Cleary
SharePoint MVP
Intro
Note: This blog is to be used with the SharePoint Essentials Toolkit, you can use the link at the bottom of this article to get it.
Understanding how permissions are set within your SharePoint environment is extremely important, especially when these permissions can change almost daily. With the SharePoint Essentials Toolkit, you can easily run a report that outlines all of the permissions within your SharePoint site.
Before running the report, you will need to have registered either your SharePoint On-premises or SharePoint Online site. To start press the SharePoint link in the core navigation at the top of the application, then select the Home link.
Within the My SharePoint Environment you will see listed all of your environments whether On-premises or Online. Select the site you want to run the report on, and expand the site.
Next select the SharePoint site you want to run the permission report for, right click, choose Create Reports, then select the Permissions Report option.
You will be then sent to the Create Permissions Report, where you can then set the parameters for the report. The reporting mechanism within the toolkit relies on jobs that run and output the results based on the settings you define. Set the Job Name to be something that you will remember and also makes sense to the type of report you are creating.
Now you need to select the URL or URLs to scan.
Selecting the Multiple Sites option will allow you to select more than a single site.
When using this option, you will need to press the OK button in the picker to save the values. Now you need to either confirm the current credentials or set them as needed. To do this expand the Credentials option by using the Show arrow on the right.
If you have not set any security previously then select the type of Authentication you wish to use.
Then set the username and password for your SharePoint environment.
Once complete you can then close that section by using the Hide arrow on the right.
The parameters for the report can also be modified within the Report Options section. Select the options that you need for the report.
Now that you have defined the parameters for the report, the rest of the report settings are for items to include or exclude along with the email settings. Email recipients can be typed into the box using semicolons as the divider.
You can also set the format of the permissions report, whether in Excel (.xlsx), Report (.qpcx) or Log (.csv) format.
Each view that is available can be modified based on you selecting from the choices. By default, these are set to the “All” type reports.
You can set these to any of the values to match the type of report you wish to run. Once these are set you can then either include or exclude lists based on the text you type. So, for example if you have a list called Accounts and you don’t want that to be inspected, then you can type that into the exclusion option.
The reports themselves can also be exported directly into SharePoint instead of to different file attachments. Selecting either the Site Permissions Report Export Options or List Permission Reports Export Options, Unique Item Report Export Options, and Site Collection Administrator Report Export Options, allow you to set this.
Once you have set the properties you need the job can then be saved, by clicking the Save Job button. Once done you can then either Run Now or Schedule Job. Choosing the Schedule Job button, you can setup a schedule that can run either One Time, Daily, Weekly or Monthly. You can also set it to re-occur as needed.
Within the advanced settings, you can then set the job to expire and also disable the job.
Once the schedule is saved, you can then click the Jobs link from the main navigation and see the job that you created.
From here you can start the job by right clicking on the new job and choosing the Run Now option. This will then run the report and email the users that you defined within the configuration.
Once the job has run you will then receive an email containing the data that was emailed from the toolkit. The email will contain attachments for each report section that you specified in the job.
The attachments in the email are zip files that are named based on the type of report and the date.
When they are extracted the Excel, files are also named the same.
Each report is grouped automatically and can be expanded as needed within Excel.
The toolkit however, does have predefined reports that you can run as needed too. These can be accessed by selecting the Security link from the main navigation, then clicking the Check User Permissions.
The toolkit does also have predefined reports that you can run as needed too. These can be accessed by selecting the Security link from the main navigation, then clicking the Check User Permissions.
The Check Permissions report allows you select the user or group from a picker, that will lookup accounts based on what you type.
This report functions the same as a custom one, in that you can set the same properties, then save, schedule and run the job that it creates.
When the report jobs have been completed and ran, you can then either access the report from the email that was sent, by right clicking the job and choosing the View Reports option or by viewing them within the Security tab of the core application.
The Security tab gives you easy access to previously ran Permission reports, by accessing the Reports link, and selecting either All List Permissions, All User Permissions, All Unique Item Permissions and All Site Collection Administrators.
This gives you a screen where you can view the raw data in a different format other than the selected output for the job. You can also re-group the data by dragging the column headers, as well as modify the column header data by right clicking on the header. Grouping the results allows you to take the results and make it easier to view.
Right clicking the added columns on the header allows you to launch the Group Summaries, which displays the current group ordering as well as the sort order you have specified.
Once you have the grouping defined you can then right click and choose any of the options available.
There are two advanced options available within the right click menu, they are Filter Editor and Show Search Panel. Choosing the Filter Editor will allow you to create custom filter values, as well as combine different operator filter together.
Enabling the Search Panel gives you inline search for the results listed below.
Lastly you can use the predefined views that are available in the View picker to view the data in easier ways.
The ability to create and then filter permissions reports for your SharePoint farm is a powerful feature of the SharePoint Essentials Toolkit.
- SharePoint Top 5 Features for Newbies - December 17, 2018
- SharePoint versus OneDrive - December 17, 2018
- How to Cleanup SharePoint User Permissions - July 25, 2017