SharePoint Online PowerShell Listar todos los usuarios con su rol de todos los sitios

Question

Hola, buenas

Les quería consultar si conocen una forma de listar todos los usuarios con sus roles de todos los sitios o un listado de sitios del Tenant de SharePoint Online a través de PowerShell?

Gracias.

Answer 1

Hi @Jairo Javier Baleta Cali ,

Since the Q&A Community currently only provides English support,I would like to recommend you use English so that we can better understand your needs，thank you.
I translated your request using the translation tool:

According to your description, you can follow the steps below to achieve your requirements.

First, go to SharePoint admin center as a global admin. You can see all site collections in the tenant in the "Active sites" section.

Then, run the following Powershell script to get a list of all users in the site collection and their permissions.

#Function to Get Permissions Applied on a particular Object, such as: Web, List or Folder  
  
Function Get-PnPPermissions([Microsoft.SharePoint.Client.SecurableObject]$Object)  
  
{  
  
    #Determine the type of the object  
  
    Switch($Object.TypedObject.ToString())  
  
    {  
  
        "Microsoft.SharePoint.Client.Web"  { $ObjectType = "Site" ; $ObjectURL = $Object.URL; $ObjectTitle = $Object.Title }  
  
        "Microsoft.SharePoint.Client.ListItem"  
  
        {  
  
            $ObjectType = "Folder"  
  
            #Get the URL of the Folder  
  
            $Folder = Get-PnPProperty -ClientObject $Object -Property Folder  
  
            $ObjectTitle = $Object.Folder.Name  
  
            $ObjectURL = $("{0}{1}" -f $Web.Url.Replace($Web.ServerRelativeUrl,''),$Object.Folder.ServerRelativeUrl)  
  
        }  
  
        Default  
  
        {  
  
            $ObjectType = $Object.BaseType #List, DocumentLibrary, etc  
  
            $ObjectTitle = $Object.Title  
  
            #Get the URL of the List or Library  
  
            $RootFolder = Get-PnPProperty -ClientObject $Object -Property RootFolder     
  
            $ObjectURL = $("{0}{1}" -f $Web.Url.Replace($Web.ServerRelativeUrl,''), $RootFolder.ServerRelativeUrl)  
  
        }  
  
    }  
  
     
  
    #Get permissions assigned to the object  
  
    Get-PnPProperty -ClientObject $Object -Property HasUniqueRoleAssignments, RoleAssignments  
  
   
  
    #Check if Object has unique permissions  
  
    $HasUniquePermissions = $Object.HasUniqueRoleAssignments  
  
       
  
    #Loop through each permission assigned and extract details  
  
    $PermissionCollection = @()  
  
    Foreach($RoleAssignment in $Object.RoleAssignments)  
  
    {  
  
        #Get the Permission Levels assigned and Member  
  
        Get-PnPProperty -ClientObject $RoleAssignment -Property RoleDefinitionBindings, Member  
  
   
  
        #Get the Principal Type: User, SP Group, AD Group  
  
        $PermissionType = $RoleAssignment.Member.PrincipalType  
  
      
  
        #Get the Permission Levels assigned  
  
        $PermissionLevels = $RoleAssignment.RoleDefinitionBindings | Select -ExpandProperty Name  
  
   
  
        #Remove Limited Access  
  
        $PermissionLevels = ($PermissionLevels | Where { $_ -ne "Limited Access"}) -join "; "  
  
   
  
        #Leave Principals with no Permissions assigned  
  
        If($PermissionLevels.Length -eq 0) {Continue}  
  
   
  
        #Check if the Principal is SharePoint group  
  
        If($PermissionType -eq "SharePointGroup")  
  
        {  
  
            #Get Group Members  
  
            $GroupMembers = Get-PnPGroupMember -Identity $RoleAssignment.Member.LoginName  
  
                   
  
            #Leave Empty Groups  
  
            If($GroupMembers.count -eq 0){Continue}  
  
            $GroupUsers = ($GroupMembers | Select -ExpandProperty Title | Where { $_ -ne "System Account"}) -join "; "  
  
            If($GroupUsers.Length -eq 0) {Continue}  
  
            #Add the Data to Object  
  
            $Permissions = New-Object PSObject  
  
            $Permissions | Add-Member NoteProperty Object($ObjectType)  
  
            $Permissions | Add-Member NoteProperty Title($ObjectTitle)  
  
            $Permissions | Add-Member NoteProperty URL($ObjectURL)  
  
            $Permissions | Add-Member NoteProperty HasUniquePermissions($HasUniquePermissions)  
  
            $Permissions | Add-Member NoteProperty Users($GroupUsers)  
  
            $Permissions | Add-Member NoteProperty Type($PermissionType)  
  
            $Permissions | Add-Member NoteProperty Permissions($PermissionLevels)  
  
            $Permissions | Add-Member NoteProperty GrantedThrough("SharePoint Group: $($RoleAssignment.Member.LoginName)")  
  
            $PermissionCollection += $Permissions  
  
        }  
  
        Else #User  
  
        {  
  
            #Add the Data to Object  
  
            $Permissions = New-Object PSObject  
  
            $Permissions | Add-Member NoteProperty Object($ObjectType)  
  
            $Permissions | Add-Member NoteProperty Title($ObjectTitle)  
  
            $Permissions | Add-Member NoteProperty URL($ObjectURL)  
  
            $Permissions | Add-Member NoteProperty HasUniquePermissions($HasUniquePermissions)  
  
            $Permissions | Add-Member NoteProperty Users($RoleAssignment.Member.Title)  
  
            $Permissions | Add-Member NoteProperty Type($PermissionType)  
  
            $Permissions | Add-Member NoteProperty Permissions($PermissionLevels)  
  
            $Permissions | Add-Member NoteProperty GrantedThrough("Direct Permissions")  
  
            $PermissionCollection += $Permissions  
  
        }  
  
    }  
  
    #Export Permissions to CSV File  
  
    $PermissionCollection | Export-CSV $ReportFile -NoTypeInformation -Append  
  
}  
  
     
  
#Function to get sharepoint online site permissions report  
  
Function Generate-PnPSitePermissionRpt()  
  
{  
  
[cmdletbinding()]  
  
    Param  
  
    (    
  
        [Parameter(Mandatory=$false)] [String] $SiteURL,  
  
        [Parameter(Mandatory=$false)] [String] $ReportFile,         
  
        [Parameter(Mandatory=$false)] [switch] $Recursive,  
  
        [Parameter(Mandatory=$false)] [switch] $ScanFolders,  
  
        [Parameter(Mandatory=$false)] [switch] $IncludeInheritedPermissions  
  
    )  
  
    Try {  
  
        #Connect to the Site  
  
        Connect-PnPOnline -URL $SiteURL -Interactive  
  
        #Get the Web  
  
        $Web = Get-PnPWeb  
  
   
  
        Write-host -f Yellow "Getting Site Collection Administrators..."  
  
        #Get Site Collection Administrators  
  
        $SiteAdmins = Get-PnPSiteCollectionAdmin  
  
           
  
        $SiteCollectionAdmins = ($SiteAdmins | Select -ExpandProperty Title) -join "; "  
  
        #Add the Data to Object  
  
        $Permissions = New-Object PSObject  
  
        $Permissions | Add-Member NoteProperty Object("Site Collection")  
  
        $Permissions | Add-Member NoteProperty Title($Web.Title)  
  
        $Permissions | Add-Member NoteProperty URL($Web.URL)  
  
        $Permissions | Add-Member NoteProperty HasUniquePermissions("TRUE")  
  
        $Permissions | Add-Member NoteProperty Users($SiteCollectionAdmins)  
  
        $Permissions | Add-Member NoteProperty Type("Site Collection Administrators")  
  
        $Permissions | Add-Member NoteProperty Permissions("Site Owner")  
  
        $Permissions | Add-Member NoteProperty GrantedThrough("Direct Permissions")  
  
                 
  
        #Export Permissions to CSV File  
  
        $Permissions | Export-CSV $ReportFile -NoTypeInformation  
  
     
  
        #Function to Get Permissions of Folders in a given List  
  
        Function Get-PnPFolderPermission([Microsoft.SharePoint.Client.List]$List)  
  
        {  
  
            Write-host -f Yellow "`t `t Getting Permissions of Folders in the List:"$List.Title  
  
              
  
            #Get All Folders from List  
  
            $ListItems = Get-PnPListItem -List $List -PageSize 2000  
  
            $Folders = $ListItems | Where { ($_.FileSystemObjectType -eq "Folder") -and ($_.FieldValues.FileLeafRef -ne "Forms") -and (-Not($_.FieldValues.FileLeafRef.StartsWith("_")))}  
  
            $ItemCounter = 0  
  
            #Loop through each Folder  
  
           ForEach($Folder in $Folders)  
  
            {  
  
                #Get Objects with Unique Permissions or Inherited Permissions based on 'IncludeInheritedPermissions' switch  
  
                If($IncludeInheritedPermissions)  
  
                {  
  
                    Get-PnPPermissions -Object $Folder  
  
                }  
  
                Else  
  
                {  
  
                    #Check if Folder has unique permissions  
  
                    $HasUniquePermissions = Get-PnPProperty -ClientObject $Folder -Property HasUniqueRoleAssignments  
  
                    If($HasUniquePermissions -eq $True)  
  
                    {  
  
                        #Call the function to generate Permission report  
  
                        Get-PnPPermissions -Object $Folder  
  
                    }  
  
                }  
  
                $ItemCounter++  
  
                Write-Progress -PercentComplete ($ItemCounter / ($Folders.Count) * 100) -Activity "Getting Permissions of Folders in List '$($List.Title)'" -Status "Processing Folder '$($Folder.FieldValues.FileLeafRef)' at '$($Folder.FieldValues.FileRef)' ($ItemCounter of $($Folders.Count))" -Id 2 -ParentId 1  
  
            }  
  
        }  
  
   
  
        #Function to Get Permissions of all lists from the given web  
  
        Function Get-PnPListPermission([Microsoft.SharePoint.Client.Web]$Web)  
  
        {  
  
            #Get All Lists from the web  
  
            $Lists = Get-PnPProperty -ClientObject $Web -Property Lists  
  
     
  
            #Exclude system lists  
  
            $ExcludedLists = @("Access Requests","App Packages","appdata","appfiles","Apps in Testing","Cache Profiles","Composed Looks","Content and Structure Reports","Content type publishing error log","Converted Forms",  
  
            "Device Channels","Form Templates","fpdatasources","Get started with Apps for Office and SharePoint","List Template Gallery", "Long Running Operation Status","Maintenance Log Library", "Images", "site collection images"  
  
            ,"Master Docs","Master Page Gallery","MicroFeed","NintexFormXml","Quick Deploy Items","Relationships List","Reusable Content","Reporting Metadata", "Reporting Templates", "Search Config List","Site Assets","Preservation Hold Library",  
  
            "Site Pages", "Solution Gallery","Style Library","Suggested Content Browser Locations","Theme Gallery", "TaxonomyHiddenList","User Information List","Web Part Gallery","wfpub","wfsvc","Workflow History","Workflow Tasks", "Pages")  
  
               
  
            $Counter = 0  
  
            #Get all lists from the web   
  
            ForEach($List in $Lists)  
  
            {  
  
                #Exclude System Lists  
  
                If($List.Hidden -eq $False -and $ExcludedLists -notcontains $List.Title)  
  
                {  
  
                    $Counter++  
  
                    Write-Progress -PercentComplete ($Counter / ($Lists.Count) * 100) -Activity "Exporting Permissions from List '$($List.Title)' in $($Web.URL)" -Status "Processing Lists $Counter of $($Lists.Count)" -Id 1  
  
   
  
                    #Get Item Level Permissions if 'ScanFolders' switch present  
  
                    If($ScanFolders)  
  
                    {  
  
                        #Get Folder Permissions  
  
                        Get-PnPFolderPermission -List $List  
  
                    }  
  
   
  
                    #Get Lists with Unique Permissions or Inherited Permissions based on 'IncludeInheritedPermissions' switch  
  
                    If($IncludeInheritedPermissions)  
  
                    {  
  
                        Get-PnPPermissions -Object $List  
  
                    }  
  
                    Else  
  
                    {  
  
                        #Check if List has unique permissions  
  
                        $HasUniquePermissions = Get-PnPProperty -ClientObject $List -Property HasUniqueRoleAssignments  
  
                        If($HasUniquePermissions -eq $True)  
  
                        {  
  
                            #Call the function to check permissions  
  
                            Get-PnPPermissions -Object $List  
  
                        }  
  
                    }  
  
                }  
  
            }  
  
        }  
  
     
  
        #Function to Get Webs's Permissions from given URL  
  
        Function Get-PnPWebPermission([Microsoft.SharePoint.Client.Web]$Web)  
  
        {  
  
            #Call the function to Get permissions of the web  
  
            Write-host -f Yellow "Getting Permissions of the Web: $($Web.URL)..."  
  
            Get-PnPPermissions -Object $Web  
  
     
  
            #Get List Permissions  
  
            Write-host -f Yellow "`t Getting Permissions of Lists and Libraries..."  
  
            Get-PnPListPermission($Web)  
  
   
  
            #Recursively get permissions from all sub-webs based on the "Recursive" Switch  
  
            If($Recursive)  
  
            {  
  
                #Get Subwebs of the Web  
  
                $Subwebs = Get-PnPProperty -ClientObject $Web -Property Webs  
  
   
  
                #Iterate through each subsite in the current web  
  
                Foreach ($Subweb in $web.Webs)  
  
                {  
  
                    #Get Webs with Unique Permissions or Inherited Permissions based on 'IncludeInheritedPermissions' switch  
  
                    If($IncludeInheritedPermissions)  
  
                    {  
  
                        Get-PnPWebPermission($Subweb)  
  
                    }  
  
                    Else  
  
                    {  
  
                        #Check if the Web has unique permissions  
  
                        $HasUniquePermissions = Get-PnPProperty -ClientObject $SubWeb -Property HasUniqueRoleAssignments  
  
     
  
                        #Get the Web's Permissions  
  
                        If($HasUniquePermissions -eq $true)  
  
                        {  
  
                            #Call the function recursively                            
  
                            Get-PnPWebPermission($Subweb)  
  
                        }  
  
                    }  
  
                }  
  
            }  
  
        }  
  
   
  
        #Call the function with RootWeb to get site collection permissions  
  
        Get-PnPWebPermission $Web  
  
     
  
        Write-host -f Green "`n*** Site Permission Report Generated Successfully!***"  
  
     }  
  
    Catch {  
  
        write-host -f Red "Error Generating Site Permission Report!" $_.Exception.Message  
  
   }  
  
}  
  
     
  
#region ***Parameters***  
  
$SiteURL="https://tenant.sharepoint.com/sites/amy12345/"  
  
$ReportFile="C:\Users\spadmin\Desktop\1.csv"  
  
#endregion  
  
   
  
#Call the function to generate permission report  
  
Generate-PnPSitePermissionRpt -SiteURL $SiteURL -ReportFile $ReportFile -ScanFolders  
  
#Generate-PnPSitePermissionRpt -SiteURL $SiteURL -ReportFile $ReportFile -Recursive -ScanFolders -IncludeInheritedPermissions.  

Here is the permission report generated by this script:

Thanks,

Yanli Jiang

===========================================

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.