joseph/internal-joseph
1
0
Fork 0
Code Issues 21 Pull requests Projects Releases Packages Wiki Activity Actions

[OneDev #31] feat(m365): visual SharePoint external sharing permissions report #3

New issue
Open
opened 2026-05-24 04:46:35 +00:00 by joseph · 1 comment
joseph commented 2026-05-24 04:46:35 +00:00
Owner
Copy link

Imported from OneDev issue #31 (id 35542)
Original project: internal-joseph
Original state: Open
Original submitterId: 5
Original submitDate: 2026-05-05T18:26:39.490+00:00
Original lastActivity: {'date': '2026-05-07T14:41:00.951+00:00', 'description': 'commented', 'userId': 5}

Original fields:

  • Type: New Feature
  • Priority: Normal
  • Assignees: None

Generate a visual report of SharePoint external sharing permissions across a tenant — which sites/libraries/files are shared externally, with whom, and what level of access. Output should be scannable (HTML table or Excel) with per-site summaries and a drill-down to individual sharing links.

Why

Clients routinely have no idea how much of their SharePoint is open to external guests or anonymous links. A periodic visual report is a quick compliance/security win and a good upsell hook for data governance work.

Imported from OneDev issue #31 (id 35542) Original project: internal-joseph Original state: Open Original submitterId: 5 Original submitDate: 2026-05-05T18:26:39.490+00:00 Original lastActivity: {'date': '2026-05-07T14:41:00.951+00:00', 'description': 'commented', 'userId': 5} Original fields: - Type: New Feature - Priority: Normal - Assignees: None Generate a visual report of SharePoint external sharing permissions across a tenant — which sites/libraries/files are shared externally, with whom, and what level of access. Output should be scannable (HTML table or Excel) with per-site summaries and a drill-down to individual sharing links. ## Why Clients routinely have no idea how much of their SharePoint is open to external guests or anonymous links. A periodic visual report is a quick compliance/security win and a good upsell hook for data governance work.
joseph commented 2026-05-24 04:46:45 +00:00
Author
Owner
Copy link

Imported from OneDev comment id 556 on issue #31
Original userId: 5
Original date: 2026-05-07T14:41:00.951+00:00

MVP shipped for Ready Construction tenant.

Method

  1. Tenant resolution: AT → Pax8 (readyconstruction.com) → Graph /organization (4c7e202a-9fce-4542-bb76-c1ec6cf3699d).
  2. Auth: Conduit /token?service=graph (existing scopes incl. Sites.Read.All, Sites.FullControl.All).
  3. Discovery: SharePoint Search KQL — ViewableByExternalUsers:1 AND IsContainer:true and ViewableByAnonymousUsers:1.
  4. Permissions: per-folder /drives/{id}/items/{id}/permissions, filtered to inheritedFrom == null.
  5. Roll-up: for each (guest, folder), if any ancestor folder is also in the guest's grant set → mark child redundant. Reduces actionable rows ~88%.

Numbers (Ready Construction)

Metric Count
Folders flagged by Search 1,995
Non-inherited external grants 8,342
Share-root grants (rolled up) 998
Unique external guests 166
"Anyone in org" links 3,697
Anonymous links 92 (all in offboarded user OneDrives, locked HTTP 423)

Artifacts

Known gaps for future iterations

  • Files with their own non-inherited grants (18,406 files flagged) not yet covered — separate crawl pass.
  • Anonymous-link items in locked OneDrives need SharePoint admin REST (Conduit service=sharepoint) to inspect; current Graph token returns 423.
  • Hardcoded for Ready Construction; tenant-agnostic refactor is a 3-line change.
  • $batch could speed perm crawl from ~5/s to ~50/s if scaled to larger tenants.
  • "Stale shares" filter (lastModifiedDateTime > 1y) for cleanup prioritization.
  • Per-guest detail view for offboarding workflows.

Generalizing into a sharepoint-external-sharing-report skill is a candidate for the skill backlog.

Imported from OneDev comment id 556 on issue #31 Original userId: 5 Original date: 2026-05-07T14:41:00.951+00:00 MVP shipped for Ready Construction tenant. **Method** 1. Tenant resolution: AT → Pax8 (`readyconstruction.com`) → Graph `/organization` (`4c7e202a-9fce-4542-bb76-c1ec6cf3699d`). 2. Auth: Conduit `/token?service=graph` (existing scopes incl. `Sites.Read.All`, `Sites.FullControl.All`). 3. Discovery: SharePoint Search KQL — `ViewableByExternalUsers:1 AND IsContainer:true` and `ViewableByAnonymousUsers:1`. 4. Permissions: per-folder `/drives/{id}/items/{id}/permissions`, filtered to `inheritedFrom == null`. 5. Roll-up: for each (guest, folder), if any ancestor folder is also in the guest's grant set → mark child redundant. Reduces actionable rows ~88%. **Numbers (Ready Construction)** | Metric | Count | |---|---| | Folders flagged by Search | 1,995 | | Non-inherited external grants | 8,342 | | **Share-root grants (rolled up)** | **998** | | Unique external guests | 166 | | "Anyone in org" links | 3,697 | | Anonymous links | 92 (all in offboarded user OneDrives, locked HTTP 423) | **Artifacts** - v1 (sample, mixed inherited): https://docs.pctbin.com/ready-construction-external-sharing-2026-05-05.html - **v2 (folders, non-inherited, share-root rollup):** https://docs.pctbin.com/ready-construction-external-sharing-v2-2026-05-05.html - Generator script: `C:/tmp/rc_sp_report_v2.py` (perm cache at `C:/tmp/rc_sp_perms_cache.json`, `REFRESH=1` to bust) **Known gaps for future iterations** - Files with their own non-inherited grants (18,406 files flagged) not yet covered — separate crawl pass. - Anonymous-link items in locked OneDrives need SharePoint admin REST (Conduit `service=sharepoint`) to inspect; current Graph token returns 423. - Hardcoded for Ready Construction; tenant-agnostic refactor is a 3-line change. - `$batch` could speed perm crawl from ~5/s to ~50/s if scaled to larger tenants. - "Stale shares" filter (lastModifiedDateTime > 1y) for cleanup prioritization. - Per-guest detail view for offboarding workflows. Generalizing into a `sharepoint-external-sharing-report` skill is a candidate for the skill backlog.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
joseph/internal-joseph#3
No description provided.