Permission Structure

See exactly how access flows.

Replace opaque SharePoint permission tables with an interactive, left-to-right visual tree. Unravel nested Entra ID groups, sharing links and broken inheritance boundaries across every document hierarchy, at the current state or at any date inside historical coverage.
Request a Permission Structure demoHow it works
Who can reach thisTenant: Contoso Industries
/sites/Finance/Shared Documents/Payroll
Unique permissions
Groups inside groups
4 levels
People with access
6 (2 external guests)
Confidence
Reconstructed

The picture

Multi-tier entitlement graph

Trace how a user at the far right gains effective permissions on a sensitive resource at the far left. The selected path is dominant; unrelated branches fade but stay discoverable.

Finance site entitlement graphTenant: Contoso Industries
Latest stateA past date
Multi-tier entitlement graph for the Contoso Finance siteLeft to right: target resources, SharePoint groups, Entra ID and Microsoft 365 groups, and effective principals. The highlighted path shows Payroll granting Read to Finance Visitors, which contains the Entra ID group Finance Contractors, which contains the external guest Alex Turner.1. TARGET RESOURCE2. SHAREPOINT GROUPS3. ENTRA ID / MICROSOFT 365 GROUPS4. PEOPLE/sites/FinanceSite collection rootRootShared DocumentsDocument libraryInherits from sitePayrollFolderUnique permissionsBoard MinutesDocument libraryUnique permissionsFinance OwnersSharePoint groupFull ControlFinance MembersSharePoint groupEditFinance VisitorsSharePoint groupReadFinance TeamMicrosoft 365 groupM365 groupFinance ContractorsEntra ID security groupDirect on PayrollExternal AuditorsEntra ID security group (nested)NestedRobert Williamsrobertw@contoso.onmicrosoft.comFull ControlJohn Smithjsmith@contoso.onmicrosoft.comEditAlex Turneralex.turner@externalpartner.examp…External guestElena Vanceelena@advisory-partners.exampleExternal guest

Explanation: Alex Turner holds Read on Payroll because the Entra ID group Finance Contractors is a member of the SharePoint group Finance Visitors, which has a Read role assignment on the Payroll folder (unique permissions since Dec 12, 2025).

Export path as JSON

What it shows

Built for the way Microsoft 365 access really works

Microsoft's admin screens show one layer at a time when access runs through Entra ID groups, Microsoft 365 groups, Teams-connected sites and sharing links.

  • Inherited vs direct

    Spot where inheritance was broken and by whom. Unique-permission boundaries and direct assignments are labeled, not just colored.

  • Groups inside groups

    Groups inside groups are opened up, however deep, and each step is shown, so you see every person and how they got there.

  • External and guest identities

    B2B guests, external users and sharing-link principals are flagged along the path so reviewers see the exposure, not just the role.

  • Historical comparison

    The same graph renders for any past instant, with confidence and coverage stated. To see what changed between two moments, compare them in Access History or in the Access Map's What changed tab.

Explainable

The same question, the same answer, every time

Every route is kept, and every step shows its evidence.

Inspector panel for Alex Turner: what they can do here, why they have it, and how the access reaches them step by step.
The inspector for Alex Turner at Feb 14, 2026: Read on FY2026 Budget.xlsx, set on the Payroll folder, reaching him through Finance Visitors and the Finance Contractors security group, with the date each link has been in place. Sample Contoso Finance data.

Historical comparison

Who gained or lost access over a period

Investigate how access to an object changed over time: Access History compares the start and the end of a period for everyone who can reach it, person by person, with the route behind each change.

Who else gained or lost access to this: Alex Turner and Elena Vance, both Changed from Read to Edit, through Payroll, Finance Visitors and Finance Contractors (and External Auditors for Elena Vance); 5 others kept the same access throughout.
In Access History: who else gained or lost access to FY2026 Budget.xlsx between Jan 15 and Jan 24, 2026, the week Finance Visitors was raised from Read to Edit on Payroll: Alex Turner and Elena Vance went from Read to Edit through groups nested in Finance Visitors, and five others kept the same access. Sample Contoso Finance data.

Comparisons run on your server, against your own database. Nothing leaves your environment to produce them.

Permission Structure

Ready to visualize your SharePoint entitlement graph?

See it on sample data in a demo, then on your own tenant during a 60-day evaluation. It only reads: it never changes permissions, sharing or content.

Book a live graph demoPrivate deployment

Never changes permissions, sharing or content. Runs on your servers.