SharePoint Permissions Scanner Under Development

Who can reach what, across a whole Microsoft 365 tenant.

Sign in as a SharePoint or Global admin, scan the tenant, and get a nine-sheet Excel workbook of every site, folder, user, group and permission — with the risky ones ranked and put on their own sheet. It reads; it never changes a permission.

Download the scanner ZIP · 10 MB · v1.5.0 · extracts to a version-stamped folder

Running it

Unzip anywhere — a desktop, a stick, a customer’s machine.
Double-click Start Scanner.cmd.
Your browser opens on the scanner. Leave the black window open while you use it.
Close that window when you are finished. Nothing is installed and nothing is left behind.

Its components travel inside the download, so there is no install step. If the machine has no Node.js runtime, it fetches its own — a single file, into its own folder, with no installer, no PATH change, no registry entry and no administrator rights. Deleting the folder removes every trace.

What it does, in four steps

Sign in as a Global Admin. A short code appears; you enter it at microsoft.com/devicelogin and sign in. Nothing is registered in your tenant and nothing is written to it — it signs in through Microsoft's own tools and reads only.
Choose scope — every option states what it will cost you in time before you pick it.
Scan — a percentage, an ETA, what each worker is doing, and risky findings appearing as they are discovered rather than at the end.
Report — the workbook, plus CSVs and the raw JSON.

What lands in the workbook

Sheet	What it is for
Overview	Dashboard, risk summary, links to every sheet, and the scan’s own limits
Risk findings	Only what needs a decision — start here
All permissions	Every grant on every object
Who has access	One row per person per object, groups already resolved
People	Per-person rollup: reach, highest permission, risky entries
Groups	Directory groups flattened to real people, nested groups included
SharePoint groups	Site Owners / Members / Visitors, and who is in them
Sharing links	Every active share link and who it lets in

How findings are ranked

Severity	Meaning
Critical	`Everyone` (which includes anonymous), or an anyone-with-the-link share
High	External guests, or company-wide edit access
Medium	Full Control granted directly on an object with broken inheritance
Info	Normal, expected access

It decodes SharePoint’s claims strings on the way past, so the report reads “Everyone except external users — Edit” rather than c:0-.f|rolemanager|spo-grid-all-users/8a1f…

Before you point it at a customer. This has been built and tested against sample data, but it has not yet been run against a live tenant — so treat the first real scan as the test. It only ever reads, so the risk is a wrong or incomplete report rather than a changed permission. The Overview sheet states what the scan could not reach.

Nothing is registered in the tenant. Sign-in rides Microsoft's own tools rather than an app of ours, so there is no app registration and no admin-consent step. The one thing that does appear is a Microsoft-owned service principal under Enterprise Applications on first use — the same object any admin PowerShell session creates, and reversible. It is not accurate to call that "nothing", so it is named here rather than hidden. Reports stay on the machine that ran the scan.

DigiCave · Tech Tools