Connect to your tenant
PermView runs entirely in your browser. It signs you in with Microsoft (PKCE) and queries Microsoft Graph, Azure Resource Manager, Power BI, Power Platform and Azure DevOps as you. No backend, no telemetry.
Sign-in initially asks only for the basic Graph read scopes. PermView asks for additional consent (per API) the first time you open a workload that needs it.
Required delegated permissions across all workloads:
User.Read,Directory.Read.All- identity and tenant lookupRoleManagement.Read.Directory- administrator role assignmentsApplication.Read.All- app registrations, enterprise apps and API permission grantsSites.Read.All,Files.Read.All- SharePoint and OneDriveCalendars.Read.Shared- mailbox calendar permissionshttps://management.azure.com/user_impersonation- Azure RBAChttps://analysis.windows.net/powerbi/api/Tenant.Read.All- Power BI workspaceshttps://service.flow.microsoft.com/User- Power Platform environments499b84ac-1321-427f-aa17-267ca6975798/user_impersonation- Azure DevOps
PermView does not write anything. It is a read-only viewer.
Debug log
About PermView
PermView is part of the LCToolkit by Lieben Consultancy. It gives you a fast, browser-only top-level view of who has permissions where across the most-used Microsoft cloud workloads. Pick a workload, point at an entity (a site, mailbox, subscription, workspace, environment, ...), and you get a flat table of principals, roles and scope.
Workloads covered
- Administrators - directory administrator roles and members
- Entra App Access - app registrations and service principals with delegated/application API permissions and credential expiry signals
- SharePoint site - app permissions (via Graph) + M365 group owners/members for group-backed sites
- OneDrive - sharing on the drive root
- Mailbox - calendar sharing permissions
- Azure - subscription-scope role assignments
- Azure DevOps - org-level security groups and members
- Power BI - workspace role assignments
- Power Platform - environment role assignments
What it does NOT do
PermView is intentionally shallow. It does not crawl subsites, libraries, items, mail folders, resource-group RBAC, project or deeper level Azure DevOps security, dataset RLS, app/flow sharing, PowerBI, PIM eligibility. It does not have integrations or alerting, automated reporting or anything else that would turn it into a real permissions audit tool. For that, use m365permissions.com.
Privacy
Tokens stay in your browser's local storage. PermView does not have a backend and does not phone home. The only outbound calls are to the Microsoft APIs needed to render the workload you picked.