See what content a group can reach across your SharePoint sites and OneDrive accounts, and how it got that access.
The Group access report starts from groups instead of content. Select one or more groups, and ShareGate Protect lists every site collection they can reach, with the access path behind each permission.
You can find the Group access report in the Reports section of ShareGate Protect.
Note: To start from a person instead of a group, use the User access report. To start from a site or a document, use the Permissions matrix report.
Before you start
The report uses data from your tenant's permissions crawl, which refreshes approximately every 24 hours. The data you see isn't real-time.
If your tenant's permissions crawl is still in progress, a Permissions scan in progress message appears on the group selection page. Results update as the scan completes. Select Refresh now to reload the page.
The report is read-only. You can't remove access from it yet.
Run the Group access report
Select Reports from the sidebar menu.
In the Oversharing and security section, click the Group access card.
Find the groups you want to report on:
Select the All, M365 groups, Security groups, or Built-in groups tab to narrow the list by group type.
Search by name.
Use the quick filters. On the M365 groups tab, select M365 group + team or M365 group (no team). On the Security groups tab, use Membership (Assigned or Dynamic) and Mail-enabled (True or False).
Select the groups with checkmarks. You can select one group or several, with no limit. The page shows how many groups you selected, and you can clear your selection. Your selection stays when you search or move between pages.
Select View report.
Group types
The Group type column and the group icons tell the types apart, in the selection table and in the report results.
M365: Microsoft 365 groups. When you select one, the report includes permissions granted to its Owners and Members. M365 groups that have a Microsoft Teams team show the Teams icon and a Has Team value.
Security: Microsoft Entra security groups. You can filter them by membership type and by mail-enabled status.
Built-in: Everyone, Everyone Except External Users, and All Users. Names appear as Microsoft returns them, for example All Users (Windows).
Read the report results
The report lists the site collections your selected groups can reach. When you select several groups, each site collection shows which of them reach it.
Site collections are collapsed by default. Expand a site collection to load its permissions.
Within each site collection, permissions appear in this order:
Site Collection Administrators (site level only)
Direct access
Group access (security groups, SharePoint groups, built-in groups, and so on)
Sharing links
Within each category, permissions are sorted by permission level, with the most permissive first.
Permissions granted to the Owners or Members of an M365 group are labeled [group name] Owners or [group name] Members. Your selection doesn't distinguish the two, so the report includes permissions granted to either.
See how a group got access
Select the View access paths icon next to a permission to open the access paths window for that item. It lists every path that leads to the item, one row per path.
What's not yet available
The following capabilities aren't available in this version of the report:
Removing access: The report is read-only. You can't remove a permission, sharing link, or membership from it yet. This is planned for a future update.
Choose the right access report
Start from a group: use the Group access report.
Start from a person: use the User access report.
Start from a site or a document: use the Permissions matrix report.