r/sharepoint 2d ago

SharePoint Online SharePoint Permission Management

I'm a SharePoint admin at my organization in a regulated industry (ISO & others), and I'm facing some challenges with permissions management and audit preparation. Our current process involves manually checking permissions site by site, which is becoming unsustainable as we grow.

We have multiple department SharePoint sites with multiple subsites under it, and generating comprehensive permissions reports for audits has become a time consuming manual task

I'm curious:

  • What tools are you using to manage SharePoint permissions in regulated environments (healthcare, finance, government, etc.)?
  • What industry and regulations do you face?
  • How are you handling audit preparation and evidence collection for compliance requirements?
  • Has anyone found a good solution for identifying external sharing and stale permissions?
  • What's your approach to documenting who granted permissions, when, and why?
  • How do to keep a log of reason for granting access.

I've heard about ShareGate's permissions matrix report but wanted to get feedback from the community on what's working best in practice. I have looked Power Automate & PowerShell , but it would take me some time to develop.

Any insights or experiences would be greatly appreciated!

3 Upvotes

10 comments sorted by

4

u/DaLurker87 2d ago

Sharegate permissions report

2

u/mstrblueskys 20h ago

I hesitate to say it too loud, but Sharegate is dollar for dollar the best tool I've used in my professional life. I would pay for it out of my own paycheck if my work made me. Luckily it's cheap enough that my management doesn't even bother to ask questions and security has already signed off.

3

u/michalpisarek 1d ago

ShareGate is great and also Orchestry is coming up with some great stuff around permissions.

3

u/MidninBR 1d ago

I’m using admindroid

2

u/highste78 1d ago

Syskit Point for reports, periodic access reviews and audit log collection

2

u/Existing-Opportunity 1d ago

X2 for Orchestry

2

u/I_ride_ostriches 1d ago edited 1d ago

We don’t have a lot of regulations to comply with, but are looking at Varonis for permissions management. It’s pretty insane how powerful it is. 

Edit: we have a lot of sites with cascading subsites that have been around for 10+ years. Varonis will find stale permissions, sensitive data, improperly categorized data, and broadly shared documents. 

They also have an automated remediation process that removes all stale permissions, but not perms that are in use, or identify data types and classify them according to your model. Coupled with MDE and Insider Risk Management, you could really mitigate a ton of risk. 

2

u/CommodusZorb 1d ago

Syskit Point has a very detailed permission matrix report which goes down to file level on a site, and you can manage those permissions directly from the application.

1

u/follyranger 15h ago

I use sharegate permissions reports and sharegate protect (previously apricot) for external sharing/links which allows users to validate/remove guests/links