Overview
Key figures, the latest scan's status, Global Administrators, sites that stand open, and disabled accounts that still hold access.
See screenshot
Permission reporting for Microsoft 365: SharePoint and Teams
See who can access what. And why.
HUX Permission Report gives a clear view of permissions on SharePoint sites and in Microsoft 365 groups, including the groups behind Teams. The report shows who has access to what, how that access is granted and when permissions changed. That makes it easier to decide which permissions to keep, which to restrict and where action is needed. Access decisions then rest on traceable information rather than guesswork.
- Hosted in your own environment
- Reads, changes nothing
- Never reads file content
Why does Anna have access?
/sites/finance › Plans › Salary budget 2027.xlsx
Path 1 of 2 Edit
- SP group Finance Members
- Security group Finance department
- Security group Payroll nested group
- User Anna Jones
Path 2 of 2 Read
- Sharing link People in your organisation, created 14 March
- User Anna Jones
Effective access, all paths combined
ViewDownloadEditDelete Manage permissions
Example with made-up names. This is how the “Why does X have access to Y?” page shows it in the product.
Why now
Access builds up without anyone noticing
Copilot finds what people can reach
Microsoft 365 Copilot answers from all the content a user has access to. Old permissions and open links can put content into answers that nobody meant to share.
Groups inside groups hide access
A SharePoint group holds a security group that holds another security group. SharePoint's permissions page shows only the group that was granted access directly. People who have left can still sit somewhere in the chain.
Reviews need visibility
Standards and regulation such as ISO 27001 and NIS2 expect access control to be in place and reviewed. That takes seeing the access, as it is today and as it was.
What it shows
Different views of one access map
Every page draws on the same scan. When the scan couldn't read something, the page says so instead of implying all is well.
Why access?
Pick an object and a user. See every path with its role and permissions, and the effective access they add up to. Click a user or group on a path to open its page.
See screenshot
Access changes
What changed between two scans: user access, sharing links and site settings, field by field. Also everything that changed on one site, grouped by who was given access.
See screenshot
Principals
Who reaches the most places and how many members each group has. Filter on disabled accounts. Every user and group has a page with the groups they are in and the group’s members, nested groups included.
See screenshot
Objects
A tree of sites, lists, folders and files with their own permissions. Each site has a profile with a risk summary.
See screenshot
Sharing links
Every link in one place. Filter on links anyone can open and search by the person who shared.
See screenshot
Site collection admins
Everyone who holds site collection admin rights, and the sites on which each of them holds them.
See screenshot
Protection gaps
Sites where sensitivity label, exposure and DLP policies don't match. Also every site a chosen DLP policy reaches.
See screenshot
Scan history
Each scan: status, duration, changes, what it couldn't read and the settings it ran with.
Watched sites
The sites on the watchlist and the new access on each since the last review. A click opens every permission change on the site, including access that was removed. The bell at the top of the web app leads here. It also shows who last reviewed the changes in the report, and when.
Copilot readiness
What sensitive content Copilot can surface and what to fix. Each failing check is a worklist with an action and a link to every site. Run it for the whole tenant or for chosen groups and users, and save it as one HTML file.
See screenshot
Microsoft 365 Copilot
Is your tenant ready for Copilot?
The Copilot readiness report is part of the product and draws on the same scan. It shows what sensitive content Copilot could surface and what needs fixing, for the whole tenant or for chosen groups and users. The assessment covers SharePoint sites; OneDrive, mail and Teams chats aren't read. What the scan couldn't read shows as unknown, never as safe.
Discovery
Whether sensitive sites that stand open are hidden from Copilot with Restricted Content Discovery, and whether every site carries a sensitivity label. These two checks decide the verdict.
What could Copilot find?
Access
Whether sensitive sites are open to everyone, whether the Microsoft 365 groups behind them are private, and whether Restricted Access Control limits who gets in. A site open on purpose that isn't sensitive, such as an intranet, passes.
Who can open sensitive content?
Protection
Whether every sensitivity label can be judged, and whether a Copilot DLP policy keeps files with sensitive labels from Copilot.
Where is protection missing?
Grant paths
Every access path is traced, not just the result
Most permission reports show only which permissions a user has. HUX Permission Report also shows how the access is granted, from SharePoint groups through Microsoft 365 groups and other security groups, all the way down to individual users. That lets you trace where permissions come from and decide where to change access without needlessly cutting anyone else’s.
- Every access path: Group membership is traced all the way down to individual users, including groups nested inside other groups.
- Groups and users: Group pages show how each member is connected to the group, directly or through other groups. User pages show every group the person belongs to.
- Admin rights: The report also covers admin roles, such as Global Administrator, and SharePoint site collection admins.
- Broad access: “Everyone except external users” reaches every employee, while “Everyone” can also reach guests.
- Exact permission levels: Localised and custom permission levels, such as “Full stjórn”, are shown with their actual permissions, not just their name.
Full Control full
Design design
Edit edit
Contribute contribute
Read read
Direct SharePoint group M365 group Nested group Everyone Sharing link
Coverage
What it reads, and what it doesn't
The collector reads who can open what in SharePoint, through which groups, and the labels and DLP policies that protect it.
Part of Microsoft 365 vs. what is read
Who has access level · by which path
Sharing links anyone · org · people
Settings and labels sharing · label · locks
File list names, not content
SharePoint sites
Communication and team sites
Yes
Yes
Yes
When turned on
Microsoft 365 group sites with or without Teams
Yes members, owners, guests
Yes
Yes
When turned on
Teams standard channels files in the team's site
Yes
Yes
Yes
When turned on
Private and shared channels a site per channel
Yes
Yes
Yes
When turned on
Viva Engage communities native mode: a group site
Yes
Yes
Yes
When turned on
Identity and protection
Entra ID users, guests, groups, roles
Group members
—
Group visibility
—
Purview sensitivity labels, DLP
—
—
When turned on
—
Not read
OneDrive incl. files shared in chats
No
No
No
No
Exchange mailboxes, group mail
No
No
No
No
Teams messages chats, channel posts
No
No
No
No
Loop and Planner Embedded containers, tasks
No
No
No
No
Read Read when turned on Not read · — does not apply Access through Microsoft 365 groups, guests included
Channel sites and Viva Engage communities are read like other sites. File content is never opened or stored.
Limits
What the product doesn't do
It changes no permissions
It shows the state of things. You decide what to fix, and “Manage access” takes you to the right place in SharePoint.
It doesn't read content
With the file inventory turned on it records which files exist and who can open them, but it never reads what they say.
It doesn't show who opened what
It shows who can open what, but doesn't read the audit log of who actually opened files.
It doesn't judge DLP incidents
It reads DLP policies and the sites they reach, but not whether a particular file matched a rule.
It doesn't count unactivated PIM roles
Entra ID roles are counted for active holders. Roles waiting for activation in PIM are not included.
Want a clearer view of who has access?
We'll give you a demo of how the product works and how it can give you a clearer view of, and more control over, access permissions.