How to Audit SharePoint Online Permissions With PowerShell

As organizations rush to adopt Microsoft 365 Copilot, a massive security blind spot is emerging: Oversharing in SharePoint Online. Microsoft 365 Copilot retrieves information through Microsoft Graph and respects existing SharePoint, OneDrive, and Microsoft 365 permissions. If content is already accessible to a user, Copilot can surface and summarize that content more efficiently.

If your SharePoint permissions are a tangled web of broken inheritance, direct user assignments, and open sharing links, Copilot might just hand your next intern a detailed summary of the company’s unreleased financial projections or executive payroll data.

Before you deploy AI across your enterprise, auditing SharePoint Online permissions is a critical prerequisite. In this guide, we will show you how to use PnP PowerShell to audit Site Collection Administrators, uncover hidden oversharing risks caused by item-level permissions, and identify risky sharing links.

The Copilot Oversharing Risk

Copilot does not create new permissions or bypass security boundaries; it simply exposes the permissions that already exist. Here is how an innocent sharing action turns into an enterprise-wide data leak:

Prerequisites: Connect with Modern Authentication

To run audits against SharePoint Online, we will use the highly efficient PnP PowerShell module. As of September 2024, PnP PowerShell requires organizations to use their own Entra ID application registration for interactive authentication, rather than relying on the historical shared PnP Management Shell application.

# Replace with your own Entra ID App Client ID
$ClientId = "Your-client-id-here" 
$SiteUrl  = "https://yourtenant.sharepoint.com/sites/Finance"

# Connect using modern interactive authentication
Connect-PnPOnline -Url $SiteUrl -Interactive -ClientId $ClientId

Step 1: Auditing Site Collection Administrators

Site Collection Administrators (SCAs) have absolute power. They bypass all item-level permissions and can access hidden files, lists, and document libraries. In a Zero-Trust environment, the number of SCAs should be strictly limited.

$ExportFolder = "C:\M365_Audits\SharePoint"

# Always verify and create the destination folder if it does not exist
if (-not (Test-Path $ExportFolder)) {
    New-Item -ItemType Directory -Path $ExportFolder | Out-Null
}

$ExportPath = Join-Path -Path $ExportFolder -ChildPath "SCA_Audit.csv"

Write-Host "Retrieving Site Collection Admins..." -ForegroundColor Cyan

# Fetch all SCAs
$Admins = Get-PnPSiteCollectionAdmin

$Report = @()
foreach ($Admin in $Admins) {
    $Report += [PSCustomObject]@{
        SiteUrl     = $SiteUrl
        LoginName   = $Admin.LoginName
        IsHidden    = $Admin.IsHiddenInUI
        Principal   = $Admin.PrincipalType
    }
}

$Report | Export-Csv -Path $ExportPath -NoTypeInformation
Write-Host "Audit complete. Report saved to: $ExportPath" -ForegroundColor Green

Step 2: Broken Inheritance vs. Oversharing

Not every unique permission represents a security problem. Many organizations intentionally break inheritance to isolate sensitive workloads (e.g., locking down a specific library to just Finance Managers). The true risk emerges when unique permissions grant broader access than intended, especially through organization-wide groups or sharing links.

Auditing Item-Level Permissions

The biggest Copilot risks hide at the item and folder level, not just the library level. The following script scans a specific library for any folders or files that do not inherit permissions from the parent.

# Name of the library to scan (e.g., "Documents")
$LibraryName = "Shared Documents"
$ExportPath = Join-Path -Path $ExportFolder -ChildPath "ItemLevel_Permissions.csv"

Write-Host "Scanning '$LibraryName' for unique item permissions..." -ForegroundColor Cyan

# Get all items in the library, checking if they have unique role assignments
$Items = Get-PnPListItem -List $LibraryName -PageSize 500 `
    -Includes HasUniqueRoleAssignments, FileSystemObjectType, FieldValues

$Report = @()
foreach ($Item in $Items) {
    if ($Item.HasUniqueRoleAssignments -eq $true) {
        $Report += [PSCustomObject]@{
            Type     = $Item.FileSystemObjectType
            Title    = $Item.FieldValues["FileLeafRef"]
            Path     = $Item.FieldValues["FileRef"]
            Unique   = $true
        }
    }
}

$Report | Export-Csv -Path $ExportPath -NoTypeInformation
Write-Host "Found $($Report.Count) items with unique permissions." -ForegroundColor Yellow

Step 3: Auditing Sharing Links and Broad Groups

The “Copilot Danger Zone” is populated by legacy sharing links (like “Anyone with the link”) and broad groups (like “Everyone except external users”) applied to sensitive documents.

Finding Broad Permission Groups

If you identify an item with broken inheritance, you must inspect the actual roles assigned to it. If you see groups like Everyone, Everyone except external users, or All Authenticated Users, you have found a potential Copilot oversharing risk.

# Inspecting roles on a specific item (Replace with actual Item ID)
$ItemId = 5 
$Roles = Get-PnPListItemRoleAssignment -List $LibraryName -Identity $ItemId -Includes Member, RoleDefinitionBindings

foreach ($Role in $Roles) {
    Write-Host "Principal: $($Role.Member.Title)"
    foreach ($Binding in $Role.RoleDefinitionBindings) {
        Write-Host "  - Permission: $($Binding.Name)"
    }
}

Native Microsoft Alternatives

While PowerShell is excellent for targeted scripting and remediation, Microsoft recommends utilizing built-in enterprise tools for comprehensive Copilot readiness:

• SharePoint Advanced Management (SAM): Offers advanced reporting on oversharing, data access governance, and site lifecycle management.
• Restricted SharePoint Search: A temporary control to limit Copilot’s search scope to a curated list of sites while you clean up permissions.
• Microsoft Purview: Use sensitivity labels and Data Loss Prevention (DLP) to classify and protect data at the file level.
• Access Reviews: Regularly mandate data owners to review and attest to group memberships.

Conclusion

For Microsoft 365 Copilot, the real challenge is not AI. The real challenge is permission hygiene. Broken inheritance, legacy sharing links, broad access groups, orphaned accounts, and unmanaged content sprawl can all expand the information Copilot can legitimately access. A comprehensive readiness assessment should therefore include Site Collection Administrators, unique permissions at every level, sharing links, inactive identities, and ongoing governance controls.

Discovering oversharing is only part of the problem. If your Active Directory is littered with disabled users, orphaned guest accounts, or inactive employees, these identities might still hold residual permissions in SharePoint. To truly prepare your tenant for AI, consider using SPClean. SPClean automates the remediation of dormant accounts and abandoned SharePoint resources, dramatically shrinking your attack surface and reducing the noise Copilot has to filter through.