Free Microsoft 365 access auditing for organisations without Business Premium.
PowerShell toolkit that audits who has access to what across SharePoint Online, Teams, M365 Groups, and Entra ID - and writes it all to a single timestamped Excel workbook.
Microsoft's access-governance tooling - Access Reviews, entitlement management, guest lifecycle policies, sign-in reporting - requires Entra ID P1/P2 (bundled with Microsoft 365 Business Premium and E3/E5). Organisations on Business Basic/Standard with Entra ID Free get none of it: no way to review guest access, no membership attestation, no permission reports.
This toolkit fills that gap using only free, read-only PowerShell APIs available on every tenant:
- Complete inventory of SharePoint permissions, down to folder/item level
- Every guest and external account flagged (
IsExternal) across all surfaces - Teams vs SharePoint membership drift detection
- Full Entra ID guest inventory, including invitations that were never accepted
No licences to buy, no agents to install, nothing written back to the tenant. One browser sign-in, one Excel workbook out.
Step 1 - Install required modules (one-time, no admin required):
pwsh -File setup/Install-SPRBAC7Modules.ps1Step 2 - Edit the CONFIG section at the top of your chosen script: set $AdminUrl to https://YOUR-TENANT-admin.sharepoint.com.
Step 3 - Run the audit:
| Need | Script |
|---|---|
| Quick permissions review | pwsh -File src/simple/Invoke-SPRBACSimple.ps1 |
| Full M365 audit | pwsh -File src/advanced/Invoke-SPRBAC7.ps1 |
Both scripts open a browser login once, then run silently.
Lightweight SharePoint-only audit. Requires PowerShell 7.4+.
Produces 3 Excel sheets:
| Sheet | What it captures |
|---|---|
| SP_SiteAdmins | Site Collection Administrators per site (bypass all permissions) |
| SP_Groups | Full membership of every SharePoint group (Owners / Members / Visitors / Custom) |
| SP_RoleAssignments | Direct role assignments at web scope (permissions outside groups) |
All sheets include an IsExternal flag marking guest/B2B accounts (#EXT#).
Modules required: PnP.PowerShell, ImportExcel
Full M365 deep-audit with parallel processing. Requires PowerShell 7.2+.
Produces 16 Excel sheets:
| Sheet | What it captures | Toggle |
|---|---|---|
| Summary | Run metadata & row counts | always |
| SiteProperties | Site metadata & sharing settings | always |
| SiteAdmins | Site Collection Administrators | always |
| SP_Groups | SharePoint group membership | always |
| SP_WebRoleAssignments | Direct web-level role assignments | always |
| SP_ListRoleAssignments | List/library permissions (broken inheritance) | $IncludeListLevel |
| SP_FolderRoleAssignments | Folder-level permissions | $IncludeFolderLevel |
| SP_ItemRoleAssignments | Individual file/item permissions | $IncludeItemLevel |
| SP_SharingLinks | Externally shared items (Search API) | $IncludeSharingLinks |
| SP_ExternalUsers | External users per site | always |
| Teams_Members | Teams membership & roles | $IncludeTeams |
| Teams_PrivateChannels | Private & shared channel membership | $IncludeTeams |
| M365Groups_Members | M365 Unified Group membership | $IncludeM365Groups |
| EntraID_Guests | All B2B guest accounts in Entra ID | $IncludeEntraID |
| Teams_vs_SP_Diff | Membership mismatches between Teams/SP | $IncludeTeams |
| Teams_vs_SP_Summary | Mismatch counts per team | $IncludeTeams |
Modules required: PnP.PowerShell, ImportExcel, and optionally MicrosoftTeams, ExchangeOnlineManagement, Microsoft.Graph.Authentication, Microsoft.Graph.Users (installed by setup/Install-SPRBAC7Modules.ps1).
Pre-installs all modules from PSGallery. Run once before using the audit scripts.
# Install for current user (default, no admin required)
pwsh -File setup/Install-SPRBAC7Modules.ps1
# Install for all users (requires admin)
pwsh -File setup/Install-SPRBAC7Modules.ps1 -Scope AllUsers
# Force re-install/upgrade
pwsh -File setup/Install-SPRBAC7Modules.ps1 -Force- PowerShell 7.2+ (7.4+ for the simplified script) - free, download here
- SharePoint Administrator role (or Global Admin)
- No paid licences required. Works on Entra ID Free. The only P1-dependent field is guest
LastSignInDateTime, which is skipped gracefully (left empty) on free tenants - everything else is fully functional.
MIT - see LICENSE.