ControlPoint 8.9 - for Microsoft 365 User Guide

Analyzing Permissions by List Item

The Permissions by List Item analysis lets you examine user permissions for folders and items within selected lists.

NOTE:  List item permissions are also included as part of Comprehensive Permissions analysis.  

To generate a Permissions by List Item analysis:

1Select the list(s) whose item permissions you want to analyze.

2Choose Users and Security > Permissions by List Item.

3If you want to analyze only specific items within the selected scope, select the items you want to analyze.

4Specify the parameters for your analysis.

Now you can:

·run the operation immediately (by clicking the [Run Now] button)

OR

·schedule the operation to run at a later time or on a recurring basis.

OR

·save the operation as XML Instructions that can be run at a later time.

The first row of the result set includes the following information about the list itself:

·an icon that identifies the list type (document library, calendar, task list, etc.).

·the name of the list

·the List Security type (Inherited or Unique)

·the number of Items in the list

·the number of Items with Unique Permissions.

When the first row is expanded, each user with permissions for the list is displayed, along with the following information:

·the name of the SharePoint User

·the number of Accessible Items (that is, the number of items within the list for which the user has permissions)

·the user's permission level(s) for the list itself, as indicated by a plus sign (+) in the applicable column(s), which may include:

§the site collection's Admin group

§the five default SharePoint permission levels:

§Full Control

§Design

§Contribute

§Read

§Limited.

NOTE:  If a user has a template-specific or custom permission level, it is recorded in the Other column.

The remaining rows contain detailed permissions information for each folder and item within the list.

Click a list, folder, or item name to open the SharePoint Permissions page.

Note that in the following example, the external user is identified by his external email address.

Analyzing Comprehensive Permissions

The Comprehensive Permissions analysis shows the permissions that users (including external users) have to selected sites as well as lists (and optionally, list items) within those sites.  

If you want to analyze site-level permissions only (with the option of drilling down to list permissions for each user individually), you can run a Site Permissions analysis instead.

NOTE:  The Comprehensive Permissions analysis always uses real-time (not cached) data.

To generate a Comprehensive Permissions analysis:

1Select the object(s) on which you want to perform the analysis.

2Choose Users and Security > Comprehensive Permissions

3Specify the parameters for your analysis.

Note that, In addition to the "standard" parameters, you have the option to Group by Sites (the default) or Users.

NOTE:  By default, permissions for list items are excluded from the analysis.  You can, however, chose to Include List Items.  Be aware however, that processing time may increase significantly.

Now you can:

·run the operation immediately (by clicking the [Run Now] button)

OR

·schedule the operation to run at a later time or on a recurring basis.

OR

·save the operation as XML Instructions that can be run at a later time.

Because Comprehensive Permissions analyses are always run on real-time data, if your analysis encompasses multiple users, sites, lists, and/or list items, the analysis may run very slowly and the result set may be very large.  Therefore, you may want to consider running it by schedule.

In addition to the same site-level permissions (Site Security) shown in the Site Permissions by Site analysis, the User Rights section also shows the same list-level and optionally, item-level permissions (List Security) shown in the Site Lists Permissions analysis.

Analyzing SharePoint Groups

The SharePoint Groups Analysis provides details about membership and permissions of SharePoint groups within one or more site collections and/or sites.  

To generate a SharePoint Groups analysis:

1Select the object(s) for which you want to analyze SharePoint groups.

2Choose Users and Security > SharePoint Group Analysis.

3Specify the parameters for your analysis.

In addition to the "standard" parameters for permissions analyses, you can limit results to:

§SharePoint groups whose name include a specific text string

§groups with no members and/or with no permissions or only groups with both members and permissions

NOTE:  Currently, you can only report on groups with no permissions if the ControlPoint Configuration Setting "Show SharePoint Groups with No Permissions in Hierarchy" is set to true.  (See the ControlPoint Administration Guide for details.)

You can also choose whether to Include lists and list items in results.

CAUTION:  If you chose to include lists and list items, the analysis may take significantly longer to run and may generate a much larger set of results.

Now you can:

·run the operation immediately (by clicking the [Run Now] button)

OR

·schedule the operation to run at a later time or on a recurring basis.

OR

·save the operation as XML Instructions that can be run at a later time.

The SharePoint Group Analysis consists of the following sections:

·Membership

·Permissions

Membership Section

The Membership section lists each site collection within the scope or your analysis.

When expanded the following information displays:

·each SharePoint Group within the site collection

·the No of users in the group.

·a plus sign (+) identifying each group that Has Permissions.

When expanded, each Member login name and Display Name is listed.

Permissions Section

The Permissions section lists each site within the scope of your analysis.

When expanded, a Site Security summary row indicates whether site security is Inherited or Unique.  Each SharePoint Group within the site is listed, along with a plus sign (+) identifying each of its permissions.  Any custom permissions levels are recorded in the Other column.

Note that in the following example, the external user is identified by his external email address.

Auditing Activities and Changes in Your SharePoint Environment

SharePoint captures activities and changes to the environment via the following mechanisms:

·the Audit Log, which focuses on activities performed by SharePoint users.

·the Change Log, which focuses on changes made to the SharePoint environment.  

ControlPoint provides functionality that enables you to view contents of audit logs and change logs, which is not currently available in SharePoint.