Microsoft 365
RBAC relationships

SharePoint permission relationships Melbrooke Ltd (2026-07-02)

Pick a site or a person to map. Filters below isolate by permission level and by how access is granted.

Level

Granted via

Discrepancies ▸

The audit headline - over-permissioned users, oversized groups, direct grants, external access, and broken-inheritance debt. Click to expand; then click any finding to drill in.

Estate overview

One row per site - principals, level mix, carve-outs, external exposure. Click a site to map it. Sorted busiest-first; search to jump.

Relationship map

Pick a site or person, then click any node, evidence row, or filter to drill in. The ↗ on a node opens it in SharePoint.

LevelFull Edit Read Bands thicker = reaches more direct grant Granted via labelled on each node Broken inheritance access differs same as site

Broken inheritance. SharePoint sites and libraries inherit their permissions by default, so every item in the Unique permissions column is an exception where that inheritance was broken. Usually no one did this on purpose - sharing a file or folder with a specific person silently breaks its inheritance and adds them directly. Access differs (red outline) means the item really grants different access than the site, so it is worth reviewing. Same as site (grey) means a frozen copy of the site's permissions - harmless today, but detached, so it won't track future site changes (drift risk).

Direct (individual) grants. A dotted line is access given straight to a person, bypassing the site's groups - the hardest kind of access to keep track of. When it sits on a broken-inheritance item, the person is tagged item-level; in SharePoint they show as Limited Access on the site, which is traversal only (they can reach that one item and nothing else on the site). A long list of these is an over-sharing signal - content handed out file by file instead of through a group.

Focus or person or group Access-differs only Show libraries

Evidence

Principal	Reaches	Scope	Level	Granted via	Inheritance

Compare two users

Spot access discrepancies - a new hire vs their predecessor, two peers, etc. Shows shared access and what each has that the other does not.

Prepared by Glow Cloud SolutionsMelbrooke Ltd · 2026-07-02 · Confidential