See what a person can access across your SharePoint sites and OneDrive accounts, and how they got that access.
The User access report starts from people instead of content. Select one or more users, and ShareGate Protect lists every site collection they can reach, with the access path behind each permission.
You can find the User access report in the Reports section of ShareGate Protect.
Note: To start from a site or a document instead of a person, use the Permissions matrix report.
Before you start
The report uses data from your tenant's permissions crawl, which refreshes approximately every 24 hours. The data you see isn't real-time.
If your tenant's permissions crawl is still in progress, a Permissions scan in progress message appears on the user selection page. Results update as the scan completes. Select Refresh now to reload the page.
The report is read-only. You can't remove access from it yet.
Run the User access report
Select Reports from the sidebar menu.
In the Oversharing and security section, click the User access card.
Find the users you want to report on:
Search by name.
Select the Guest, Unlicensed, or Deactivated quick filter to narrow the list.
Select the users with checkmarks. You can select one user or several, with no limit. Your selection stays when you search or move between pages.
Select View report.
Read the report results
The report lists each selected user, with the site collections they can reach below. Guests show a Guest tag next to their name. A subtitle shows how many users you selected.
Site collections are collapsed by default. Expand a site collection to load its permissions. A badge next to each item shows how many items the user can access. Permissions inherited from a parent item stay hidden until you expand them.
Within each site collection, permissions appear in this order, with the most permissive first:
Site Collection Administrators
Direct access
Group access
Sharing links
When you select several users, each user appears with their own site collections and permissions.
Users with tens of thousands of site collections can take several seconds to load.
If a user has no permissions, the report shows No site collection permissions. If no users match your selection, it shows No users found.
See how a user got access
Select the View access paths icon next to a permission to open the Access paths to window for that item. The window summarizes how the user reaches the item and which permission level it grants. It then lists every path that leads to the item, five at a time.
Each path is a chain of steps from the user to the source of the access. Select Show more on a long path to see every step, or Show less to collapse it.
Access paths are available for permissions granted through:
Site Collection Administrators
A group, including nested groups
A sharing link
Direct access to an item appears on its own row, without an access path.
View a user's access from their details
The same access view appears on the Permissions tab of a user's details page.
What's not yet available
The following capabilities aren't available in this version of the report:
Removing access: The report is read-only. You can't remove a permission, sharing link, or membership from it yet. This is planned for a future update.
Deleted and orphaned users: You can't select users that no longer exist in Microsoft Entra ID. Their leftover permissions still appear in the Permissions matrix report. Deactivated accounts can be selected with the Deactivated quick filter.
External users without a guest account in Microsoft Entra ID: You can't select them, unlike guests. You can find them in the Permissions matrix report.
Sorting: Site collections aren't sorted.
Path count: The report doesn't show how many access paths lead to a permission.
How this compares to the Permissions matrix report
The two reports answer opposite questions. Use them together to look at access from both directions.
User access report | Permissions matrix report | |
Starting point | One or more people | A site or a document |
Question it answers | What can this person access, and how? | Who can access this content? |
Removing access | Not available yet | Available one item at a time |