Export SharePoint Permissions to Excel

Someone asks who has access to a SharePoint site. It might be an auditor, a manager or you, a week before a tenant move. You open the permissions page and find no Export button.

I get this request often. This guide shows four ways to export SharePoint permissions and group members to Excel, what every method leaves out and how to tidy the sheet so people can use it.

Why Export SharePoint Permissions and Group Members?

Four jobs bring people here. An audit asks who can open a folder. A leaver check asks where a former employee still has access. A quarterly review asks whether Owners, Members and Visitors still hold the right people. A migration plan asks which accounts must exist in the target tenant.

Group members and permissions are two different lists. Members tell you who sits in a group. Permissions tell you what that group, or a single person, can reach. Most Microsoft options cover only one of the two, so know which one you need before you start.

Admins ask Microsoft the same question. In a Microsoft Q&A thread on exporting a site's members list, a Microsoft reply says Export to Excel only exports the items in the current view of a list or library. It does not export users.

Which Export Method Fits Your Scope?

Start with the size of the question. One group, one site, many sites and one person all need different routes.

How do You Export SharePoint Group Members to Excel With OData?

This is the quickest way to get one group into a sheet, and it needs no script. SharePoint exposes group members through its REST API, and Excel can read that address as a data feed.

1. Open the group. On the site, open Site settings, select People and groups, then open the group you want.
2. Copy the group ID. Look at the address bar. The group ID is the number in the part of the address named like MembershipGroupId.
3. Build the data address. Use your own site address and group ID in the format below.

   https://contoso.sharepoint.com/sites/marketing/_api/web/sitegroups/getbyid(5)/users

4. Open the data feed in Excel. Select Data, then Get Data, then From Other Sources, then From OData Feed.
5. Paste the address. Select OK and sign in with your work account if Excel asks.
6. Load the table. Select the users table and choose Load. You get a sheet of users with fields like Title, LoginName and Email.

The sheet stays linked to the site, so Data, then Refresh All updates it later. The limit is scope. You get one group at a time, so ten groups mean ten rounds of these steps. Move to PowerShell when the list gets long.

How do You Export a SharePoint Site Sharing Report?

Microsoft has one built in report for a single site. It lists items shared with direct access and the people who can reach them. Microsoft's guide to sharing reports says you must be a site admin.

1. Open Site usage. Open the site, select the Settings menu, then Site usage.
2. Start the report. Under Shared with external users, select Run report.
3. Choose a save location. Choose a folder on the site and select Save. The report is saved there as a CSV file.
4. Wait for the email. Microsoft sends an email with a link when the report is ready. It can take some time on a large site.
5. Open the CSV in Excel. Read it from the folder you chose.

The CSV holds one row for every user and item pair with direct access. The columns are Resource Path, Item Type, Permission, User Name, User E-mail, User or Group Type, Link ID, Link Type and AccessViaLinkID.

How do You Export SharePoint Permissions With PowerShell?

PowerShell is the right choice for many groups or many sites. Install the SharePoint Online Management Shell module and connect as a SharePoint admin. Microsoft's page on the Get-SPOUser cmdlet adds a second rule. You must also be a site collection admin of every site you query.

Start with one site. This script lists every group, reads its members and writes one CSV file.

Connect-SPOService -Url https://contoso-admin.sharepoint.com
$site = "https://contoso.sharepoint.com/sites/finance"
Get-SPOSiteGroup -Site $site | ForEach-Object {
  $g = $_.Title
  Get-SPOUser -Site $site -Group $g -Limit "All" |
    Select-Object @{n='Group';e={$g}}, DisplayName, LoginName
} | Export-Csv -Path .\finance-members.csv -NoTypeInformation

Get-SPOSiteGroup lists the groups on a site. Get-SPOUser with the Group switch returns the members of one group. The Limit switch matters, because Microsoft documents a default of 500 users. Setting it to "All" returns everyone.

For many sites, loop over Get-SPOSite. Microsoft's own example for groups uses the same pattern.

Get-SPOSite -Limit All | ForEach-Object {
  $url = $_.Url
  Get-SPOSiteGroup -Site $url | ForEach-Object {
    $g = $_.Title
    Get-SPOUser -Site $url -Group $g -Limit "All" |
      Select-Object @{n='Site';e={$url}}, @{n='Group';e={$g}}, DisplayName, LoginName
  }
} | Export-Csv -Path .\all-site-members.csv -NoTypeInformation

Expect errors for any site where you are not a site collection admin. Add yourself first or the site is missing from your file. Open the CSV in Excel with Data, then From Text/CSV, and choose UTF-8 if names look broken.

PnP PowerShell can do the same job with Get-PnPGroup and Get-PnPGroupMember. A Microsoft Q&A answer on exporting a full permission list shares a community script and warns that it only reports sites where your account is a site admin or owner.

Power Automate can also build the file. A flow calls the SharePoint REST endpoint for site groups, parses the JSON and writes a CSV. It works, but you need a schema and a flow for every site, so I keep it for reports that must repeat on a schedule.

How do You Export a Data Access Governance Report?

This route answers a different question. Which sites can one person reach? Microsoft's Site permissions for users report is a snapshot for the people you choose, and it is available with SharePoint Advanced Management.

1. Create the organization report first. Microsoft says you must generate the site permissions for your organization report at least once before this one.
2. Open Site permissions for users. On the Data access governance page, select View reports, then Create report.
3. Add the people. Select Add users to report, choose them and save.
4. Set scope and name. Choose SharePoint or OneDrive, enter a unique report name and select Create and run.
5. Download the CSV. When Status shows the report is ready, select Download report for one user, or Download detailed report for a ZIP of CSV files.

Every CSV lists the site URL and name, site privacy, sensitivity, external sharing, an approximate file count and the number of items with direct and indirect access. Microsoft says the data can be up to 48 hours old. You can keep up to five reports and refresh one every 30 days.

What do These Exports Miss?

Every method shows a slice. Read this table before you hand a file to an auditor.

Every export is also a snapshot. If someone changes a group tomorrow, your file is already old. Date it and treat it as a record of one moment.

How do You Clean an Exported SharePoint Permissions Sheet?

Raw exports are noisy. Login names carry a claims prefix before the email address, and system accounts sit in the list. Six quick steps fix it.

1. Keep a raw copy. Save the original CSV and work on a duplicate.
2. Split the login name. If LoginName reads i:0#.f|membership|[email protected], add a column with =TEXTAFTER(B2,"|",-1) to get the email. TEXTAFTER is in current Microsoft 365 versions of Excel.
3. Remove system rows. Delete accounts like System Account after you check that no real person uses them.
4. Remove duplicates. Select Data, then Remove Duplicates on the Group and Email columns, so a person in two groups keeps two rows.
5. Build a PivotTable. Put Email in rows and Group in columns to see who sits in more than one group.
6. Date and protect the file. Add the export date to the file name and store it where only owners can open it.

How does an Exported List Help a SharePoint Migration?

Before a tenant move, the sheet answers three questions. Which people need an account in the target tenant? Which groups hold them? Who has already left?

RecoveryTools SharePoint Migrator is a migration tool, not a permission reporting tool, so I use the export as its input. The software matches users by email automatically and reads one CSV file when addresses differ. Your cleaned list is the starting point for that mapping file, and the software ships a template with the exact columns.

I cover the full order of work in how to migrate SharePoint permissions to another tenant. Level names and defaults sit in SharePoint permission levels explained. Links people saved before the move break in a way described in what happens to SharePoint sharing links after migration. For the site level move, see how to migrate a SharePoint site to another tenant.

What are the Best Practices for Exporting SharePoint Permissions?

• Export on a schedule. A quarterly file gives you something to compare against when a question comes up.
• Date every file. A permissions list with no date is hard to trust a month later.
• Limit who can open it. The file names people and what they can reach, so store it where only owners can read it.
• Export again after big changes. A restructure or a batch of leavers makes the old file wrong.
• Write down the method. Note the steps or keep the script, so the next admin can repeat the export the same way.

Which Mistakes Ruin a Permissions Export?

Four show up again and again. First, reading a PowerShell result without the Limit switch and trusting a list that stops at 500 users. Second, treating a group name as a person. Third, forgetting that Anyone links never appear in the sharing report. Fourth, using a file that is weeks old to decide who to remove.

My Verdict on Exporting SharePoint Permissions

Use the OData link for one group, the sharing report for one site, PowerShell for many sites and the governance report for one person. Add the Limit switch every time, and date the file when you save it.

At the time of writing, Microsoft offers no single report that holds groups, members and levels together. Until it does, a short script and a clean-up routine beat any amount of manual clicking.

Frequently Asked Questions

Published 15 October 2026. Steps and limits come from Microsoft Learn pages on sharing reports, the Site permissions for users report and the Get-SPOUser cmdlet. The Export to Excel point comes from a Microsoft Q&A thread, which is community guidance and not official documentation. The OData method follows the standard SharePoint REST pattern for site groups, so test it on one group first.