How to Find Azure Groups with SharePoint Site Permissions
Question details
The user needs an automated method to audit permissions and identify users, Azure groups, and unique role assignments across more than 100 SharePoint sites.
- Product
- Microsoft SharePoint
- Device & OS
- not provided
- Scenario
- Auditing site permissions and tracking access rights across a large-scale deployment of multiple SharePoint environments.
- Observed behavior
- Manual auditing is impractical for hundreds of sites, necessitating an automated API-driven approach to retrieve site groups and unique role assignments.
Ensure you have SharePoint Site Admin or Tenant Admin privileges, as well as an active Power Automate license with premium connectors if you plan to execute external HTTP requests.
Use SharePoint REST API and Power Automate
Automate the retrieval of site groups and unique role assignments across multiple SharePoint sites using Power Automate to loop through REST API queries.
Since manual auditing is not scalable for over 100 sites, a programmatic approach is required. For sites without unique permissions, the default Visitors, Members, and Owners groups dictate access.
You can leverage Power Automate to loop through a list of your site URLs and trigger the SharePoint REST API to fetch groups and specific user IDs systematically.
Create a Power Automate flow and define an array or retrieve a list of the 100+ SharePoint site URLs you need to audit.
Within your flow's loop, use the 'Send an HTTP request to SharePoint' action targeting the endpoint `_api/web/sitegroups` to retrieve the default groups for each site.
Inspect specific lists, libraries, or items to check if they have unique role assignments (broken permission inheritance).
Use the endpoint `_api/web/getuserbyid(id)` in a subsequent HTTP request, replacing '(id)' with the retrieved identifier, to convert the ID into a readable Azure group or user name.
Map the parsed JSON results from your API calls into a centralized location, such as a SharePoint list or an Excel file, for easy auditing and review.
Need a Lightweight Office Suite for Your Daily Work?
While you manage complex SharePoint backend permissions, you might also need a reliable, cost-effective office suite for handling the reports, spreadsheets, and presentations you generate. WPS Office offers a free, highly compatible alternative to Microsoft Office.
- 1. Download the installer: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install WPS Office: Run the setup file and follow the on-screen instructions to install the lightweight suite.
- 3. Open your files: Launch WPS Office and directly open your existing .docx, .xlsx, or .pptx files to experience seamless compatibility.
Frequently Asked Questions
Can I manually check Azure groups with SharePoint site permissions without using Power Automate?
Yes, for a single site, you can navigate to Site Settings > Site Permissions to manually view the groups and users. However, this is highly impractical and time-consuming for auditing 100+ sites.
What exactly does the _api/web/sitegroups endpoint return?
This REST API endpoint returns a JSON collection of all the SharePoint groups that have been created on that specific site, including their metadata such as group IDs, titles, and descriptions.
How do I resolve an unknown group name from an ID in SharePoint?
You can append `_api/web/getuserbyid(id)` to your SharePoint site's API URL, replacing '(id)' with the numerical ID of the user or group, to retrieve their specific display name and properties.
Why do some of my SharePoint sites not show any unique permissions?
If a site, list, or item inherits permissions from its parent, it will not have unique role assignments. In these cases, the default Visitors, Members, and Owners groups dictate the access levels.
