This new version comes with the following updates:
For more info, check the TeamPermissions module page, Github or PSGallery
I lied, not just Teams, also Sharepoint and Onedrive!
As I am asked often how to report on specific permissions granted to individual (groups) of (internal/external) users….and Microsoft doesn’t have a good built-in solution, nor does the community seem to yet….this something was just asking to be coded!
My TeamPermissions PowerShell module will do exactly the above, a full report in XLSX, CSV or HTML format that contains ALL unique permissions for a given Team, Sharepoint site or Onedrive location for all files, folders, lists, list items etc. Example:
It uses the safe Entra Delegated Permission Flow for authentication so your credentials/tokens stay with you, but this does mean you have to run it as a Sharepoint Administrator (or Global Admin), there is no support for MI/SPN runs yet but can be added easily if there is much demand.
Since it exports to Excel in append mode, you could run it for multiple (or all) team sites and use e.g. Pivots to view all permissions for a given user.
Do note that although some work has been done on performance, it does not scan multiple locations in parallel yet, this will be added in a future version.
Example:
Install-PSResource -Name TeamPermissions -Repository PSGallery
#then get xlsx/html reports for the INT-Finance Department Team:
Get-TeamPermissions -teamName "INT-Finance Department" -ExpandGroups -OutputFormat XLSX,HTML
#Or get all permission for a Sharepoint site:
Get-TeamPermissions -TeamSiteUrl "https://tenant.sharepoint.com/sites/site" -ExpandGroups -OutputFormat Default
Notes
Required PS modules: PnP.PowerShell, ImportExcel
Running multiple times will append data if you don’t move the (xlsx, csv, html) file, turning the report into a multi-location report.
If you want to allow users in Sharepoint to select e.g. security groups or teams from a dropdown in a List and don’t want to manually keep that list of choices up to date….this is for you!
I’ve used Power Automate Flow for this specific scenario, but Logic Apps will of course work just as well.
First, define some variables and retrieve all the groups you want to show up in the Choice column:
Then, create a string with all the group’s names using a simple loop:
Then use ‘Send an HTTP request to Sharepoint’ to retrieve current columns (fields) defined in the list if you don’t know the GUID yet. This step is optional and uses GET to the _api/web/Lists/GetById(”)/Fields method.
Finally, use another Send an HTTP request to Sharepoint to Patch the column definition of the Choice column with the new group names.
Note we’re using PATCH for the _api/Web/Lists(guid”)/Fields(guid”) method and that I’m removing the trailing comma (,) from the data we’re patching in.
Also note that if you’re not using multiple choice but single choice you’ll need to adjust the SP.FieldMultiChoice and 15 values.
Let’s face it, Microsoft’s documentation on using Sharepoint as a data source (or sink) in ADF is pretty bad. And it doesn’t even describe how to use the Managed Identity of ADF, who still wants to register separate app credentials? Noooooo you don’t.
So here’s an example how to use Managed Identity to read a json file from a given SpO site, using minimal permissions given to ADF.
Param(
[Parameter(Mandatory=$true)][String]$displayName="{NAMEOFADFINSTANCE}",
[Parameter(Mandatory=$true)][String]$role="Sites.Selected"
)
Connect-AzureAD
$Msi = (Get-AzureADServicePrincipal -Filter "displayName eq '$displayName'")
Start-Sleep -Seconds 10
$baseSPN = Get-AzureADServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
$AppRole = $baseSPN.AppRoles | Where-Object {$_.Value -eq $role -and $_.AllowedMemberTypes -contains "Application"}
New-AzureAdServiceAppRoleAssignment -ObjectId $Msi.ObjectId -PrincipalId $Msi.ObjectId -ResourceId $baseSPN.ObjectId -Id $AppRole.Id
$Msi.AppId
For those unfortunate enough to also have an admin rename/move their Sharepoint site….you’ll be seeing errors in your logic app until you fix the URL. Sharing for those googling:
Failed to retrieve dynamic inputs. Error details: 'Resource provider 'Microsoft.Web' returned a redirect response with status code '308'. This response was blocked due to security concerns.'
Error executing the api <list url>. More diagnostic information: x-ms-client-request-id is xyz.
Unable to initialize operation
Unable to initialize operation details for swagger based operation - Get_item. Error details - Incomplete information for operation 'Get_item'
-2147024891, System.UnauthorizedAccessExceptionAccess is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))