See who has access to your SharePoint site. And how.

Add the web part to any modern page and it lists every principal with access, plus the exact chain that grants it: direct, via a SharePoint group, via a nested Entra ID group, or via a sharing link. The site-level report is free and takes seconds — no PowerShell, no stitching scripts together, no clicking through Manage Access one user at a time.

No. Microsoft's Data Access Governance "site permissions" reports sit behind a Copilot / SharePoint Advanced Management license — WhoHasAccess365 gives you the who-has-access answer without either. It's an SPFx web part that runs in your own tenant with the signed-in user's existing rights; the free site-level report needs no license at all.

The Pro item-level sweep enumerates every active sharing link on items with unique permissions and labels each by scope — anonymous ("Anyone"), organization, or specific people — plus whether it's view or edit, and its expiry. Anonymous links that were created and forgotten are exactly what this surfaces, and you can export the lot to CSV.

The free site-level report already lists every list and library that has stopped inheriting the site's permissions — the ones with their own unique permissions that no native screen shows you in one place. Pro then sweeps inside them item by item to show which specific items broke inheritance and who they're shared with.

"Everyone except external users" (EEEU) is a special claim that grants access to every internal person in your tenant at once — easy to add, easy to forget, and a common cause of quiet over-sharing. WhoHasAccess365 flags EEEU and "Everyone" wherever they appear in the report as broad-grant badges, so you can see at a glance where whole-organization access was handed out.

Because you don't have to believe it. Every download includes verify-compiled-package.js, a script that unpacks the exact package you installed and counts the HTTP verbs in the compiled code: DELETE 0, PUT/PATCH/MERGE 0, and two allowlisted POSTs that only read. The build fails if anything else ever appears. The audit table above is the complete network surface — there is no call not listed there.

No. The web part runs as whoever is looking at the page. There is one honest nuance: reading a site's complete list of role assignments requires SharePoint's "Enumerate Permissions" right, which by default is included in the Full Control and Manage Hierarchy permission levels — so site owners get the full report, and regular members may not. If you lack the right, the tool tells you exactly that in plain words instead of erroring.

Entra ID group members can only be read through Microsoft Graph, and that requires one delegated permission an admin approves once, tenant-wide. If you never approve it: everything else works, and Entra ID groups appear by name with a "not expanded" marker. Worth knowing before you approve: SharePoint applies the grant to its shared extensibility principal, so once approved, any other SPFx solution in your tenant can call Microsoft Graph with the same permission — without a further approval step. Declining is a legitimate choice, and the tool is built for it.

A fair list: (1) It reads one site at a time — it is not a tenant-wide crawler. (2) It can never see more than the signed-in user can see. (3) Without Graph consent, Entra ID group members stay hidden behind the group name. (4) It reports the state right now, not history — for "who accessed what, when", use the Microsoft 365 audit log. (5) It doesn't scan OneDrive personal sites unless you add the web part to one you can access. If a limitation isn't on this list and you find one, tell us and we'll add it here.

The site-level report takes seconds. The item-level sweep is bounded by list size: it pages through items in batches, keeps a small fixed number of requests in flight, and whenever SharePoint returns a throttling response (HTTP 429 or 503) it waits exactly as long as the Retry-After header says, then continues. That header-honoring behavior is Microsoft's own recommended practice, and it means the scan yields to real users instead of competing with them. Expect minutes on large libraries; the progress bar shows live counts.

Free answers the site-level question completely: all role assignments, SharePoint groups expanded to members, Entra ID groups by name, and which lists broke inheritance. Pro (€199 one-time per tenant) goes below site level: the item-by-item unique-permissions sweep, sharing-link enumeration, "Everyone" flags, Entra group expansion, and CSV export. No trial clocks, no feature nagging — Free stays useful forever.

One request leaves your tenant: the Pro license check, a POST to our licensing endpoint carrying the license key and your tenant hostname. Nothing else — no permission data, no user names, no telemetry, ever. The CSV is generated inside your browser and saved straight to your disk; it is never uploaded, and we couldn't read it if we wanted to. The free tier makes no external call at all.

The web part needs a modern page to live on, because that's how SPFx works. Practical workaround: add one modern page to the classic site (Site contents → New → Page) and place the web part there — permissions are site-level data, so the report covers the whole site regardless of which page it runs on. Fully classic-locked environments that can't create modern pages are the one place it can't run.

A license is issued for one tenant hostname and validated against it, so it works on every site inside that tenant and nowhere else. Buying for several tenants? Email us for a bundle — don't buy five times at list price without asking. Keys are revocable: we revoke on chargebacks and on clear abuse (like a key circulating publicly), and never for normal use. If a revocation ever hits you in error, one email fixes it.

Try Free first — it's the real report engine, not a trimmed demo, so you can evaluate the whole thing before paying anything. Because of that, and because a Pro key unlocks every feature the moment it's entered, all sales are final: HS Services doesn't offer refunds, on this product or any other in the family. If Pro doesn't do what this page says, email us — we'll fix it or explain it — but the purchase itself won't be reversed.