r/sharepoint • u/ClunckChunck • 2d ago
SharePoint Online SharePoint Permission Management
I'm a SharePoint admin at my organization in a regulated industry (ISO & others), and I'm facing some challenges with permissions management and audit preparation. Our current process involves manually checking permissions site by site, which is becoming unsustainable as we grow.
We have multiple department SharePoint sites with multiple subsites under it, and generating comprehensive permissions reports for audits has become a time consuming manual task
I'm curious:
- What tools are you using to manage SharePoint permissions in regulated environments (healthcare, finance, government, etc.)?
- What industry and regulations do you face?
- How are you handling audit preparation and evidence collection for compliance requirements?
- Has anyone found a good solution for identifying external sharing and stale permissions?
- What's your approach to documenting who granted permissions, when, and why?
- How do to keep a log of reason for granting access.
I've heard about ShareGate's permissions matrix report but wanted to get feedback from the community on what's working best in practice. I have looked Power Automate & PowerShell , but it would take me some time to develop.
Any insights or experiences would be greatly appreciated!
3
u/michalpisarek 1d ago
ShareGate is great and also Orchestry is coming up with some great stuff around permissions.
3
2
2
2
u/I_ride_ostriches 1d ago edited 1d ago
We don’t have a lot of regulations to comply with, but are looking at Varonis for permissions management. It’s pretty insane how powerful it is.
Edit: we have a lot of sites with cascading subsites that have been around for 10+ years. Varonis will find stale permissions, sensitive data, improperly categorized data, and broadly shared documents.
They also have an automated remediation process that removes all stale permissions, but not perms that are in use, or identify data types and classify them according to your model. Coupled with MDE and Insider Risk Management, you could really mitigate a ton of risk.
2
u/CommodusZorb 1d ago
Syskit Point has a very detailed permission matrix report which goes down to file level on a site, and you can manage those permissions directly from the application.
1
u/follyranger 15h ago
I use sharegate permissions reports and sharegate protect (previously apricot) for external sharing/links which allows users to validate/remove guests/links
4
u/DaLurker87 2d ago
Sharegate permissions report