[玩转系统] SharePoint Online：使用 PnP PowerShell 的网站集的用户权限审核报告
作者：精品下载站 日期：2024-12-14 15:41:30 浏览：13 分类：玩电脑
SharePoint Online：使用 PnP PowerShell 的网站集的用户权限审核报告
要求：需要一份报告来审核 SharePoint Online 网站集权限。
SharePoint Online：使用 PnP PowerShell 的网站集中的用户权限报告
审核 SharePoint Online 网站权限对于安全至关重要，因为错误配置的权限可能使用户能够访问他们不应访问的数据。因此，定期审核 SharePoint 权限对于最大限度降低数据泄露和合规性违规风险至关重要。由于没有现成的方法来生成权限报告，我们可以利用 PowerShell 获取 SharePoint 网站集的有效权限列表。此 PowerShell 脚本生成所有对象的权限报告，例如 SharePoint Online 网站集及其子网站、列表和库、文件夹以及对给定网站集具有唯一权限的列表项。它扫描以下安全对象并生成 SharePoint Online 安全报告：
- 网站集管理员组
- 给定网站集和具有独特权限的子网站
- 具有独特权限的所有列表和库
- 所有列表项（和文件夹）都具有独特的权限。
如何将网站集管理员添加到所有 SharePoint Online 网站？
SharePoint Online PowerShell 权限报告
让我们使用 PowerShell 构建 SharePoint Online 安全报告。以下是用于为 SharePoint Online 网站集生成用户权限报告的 PnP PowerShell 脚本！根据您的环境设置脚本中的SiteURL和ReportFile参数并执行脚本。您将收到输入用户名和密码的提示。
#Function to Get Permissions Applied on a particular Object, such as: Web, List, Folder or List Item
Function Get-PnPPermissions([Microsoft.SharePoint.Client.SecurableObject]$Object)
{
#Determine the type of the object
Switch($Object.TypedObject.ToString())
{
"Microsoft.SharePoint.Client.Web" { $ObjectType = "Site" ; $ObjectURL = $Object.URL; $ObjectTitle = $Object.Title }
"Microsoft.SharePoint.Client.ListItem"
{
If($Object.FileSystemObjectType -eq "Folder")
{
$ObjectType = "Folder"
#Get the URL of the Folder
$Folder = Get-PnPProperty -ClientObject $Object -Property Folder
$ObjectTitle = $Object.Folder.Name
$ObjectURL = $("{0}{1}" -f $Web.Url.Replace($Web.ServerRelativeUrl,''),$Object.Folder.ServerRelativeUrl)
}
Else #File or List Item
{
#Get the URL of the Object
Get-PnPProperty -ClientObject $Object -Property File, ParentList
If($Object.File.Name -ne $Null)
{
$ObjectType = "File"
$ObjectTitle = $Object.File.Name
$ObjectURL = $("{0}{1}" -f $Web.Url.Replace($Web.ServerRelativeUrl,''),$Object.File.ServerRelativeUrl)
}
else
{
$ObjectType = "List Item"
$ObjectTitle = $Object["Title"]
#Get the URL of the List Item
$DefaultDisplayFormUrl = Get-PnPProperty -ClientObject $Object.ParentList -Property DefaultDisplayFormUrl
$ObjectURL = $("{0}{1}?ID={2}" -f $Web.Url.Replace($Web.ServerRelativeUrl,''), $DefaultDisplayFormUrl,$Object.ID)
}
}
}
Default
{
$ObjectType = "List or Library"
$ObjectTitle = $Object.Title
#Get the URL of the List or Library
$RootFolder = Get-PnPProperty -ClientObject $Object -Property RootFolder
$ObjectURL = $("{0}{1}" -f $Web.Url.Replace($Web.ServerRelativeUrl,''), $RootFolder.ServerRelativeUrl)
}
}
#Get permissions assigned to the object
Get-PnPProperty -ClientObject $Object -Property HasUniqueRoleAssignments, RoleAssignments
#Check if Object has unique permissions
$HasUniquePermissions = $Object.HasUniqueRoleAssignments
#Loop through each permission assigned and extract details
$PermissionCollection = @()
Foreach($RoleAssignment in $Object.RoleAssignments)
{
#Get the Permission Levels assigned and Member
Get-PnPProperty -ClientObject $RoleAssignment -Property RoleDefinitionBindings, Member
#Get the Principal Type: User, SP Group, AD Group
$PermissionType = $RoleAssignment.Member.PrincipalType
#Get the Permission Levels assigned
$PermissionLevels = $RoleAssignment.RoleDefinitionBindings | Select -ExpandProperty Name
#Remove Limited Access
$PermissionLevels = ($PermissionLevels | Where { $_ -ne "Limited Access"}) -join ","
#Leave Principals with no Permissions
If($PermissionLevels.Length -eq 0) {Continue}
#Get SharePoint group members
If($PermissionType -eq "SharePointGroup")
{
#Get Group Members
$GroupMembers = Get-PnPGroupMember -Identity $RoleAssignment.Member.LoginName
#Leave Empty Groups
If($GroupMembers.count -eq 0){Continue}
$GroupUsers = ($GroupMembers | Select -ExpandProperty Title) -join ","
#Add the Data to Object
$Permissions = New-Object PSObject
$Permissions | Add-Member NoteProperty Object($ObjectType)
$Permissions | Add-Member NoteProperty Title($ObjectTitle)
$Permissions | Add-Member NoteProperty URL($ObjectURL)
$Permissions | Add-Member NoteProperty HasUniquePermissions($HasUniquePermissions)
$Permissions | Add-Member NoteProperty Users($GroupUsers)
$Permissions | Add-Member NoteProperty Type($PermissionType)
$Permissions | Add-Member NoteProperty Permissions($PermissionLevels)
$Permissions | Add-Member NoteProperty GrantedThrough("SharePoint Group: $($RoleAssignment.Member.LoginName)")
$PermissionCollection += $Permissions
}
Else
{
#Add the Data to Object
$Permissions = New-Object PSObject
$Permissions | Add-Member NoteProperty Object($ObjectType)
$Permissions | Add-Member NoteProperty Title($ObjectTitle)
$Permissions | Add-Member NoteProperty URL($ObjectURL)
$Permissions | Add-Member NoteProperty HasUniquePermissions($HasUniquePermissions)
$Permissions | Add-Member NoteProperty Users($RoleAssignment.Member.Title)
$Permissions | Add-Member NoteProperty Type($PermissionType)
$Permissions | Add-Member NoteProperty Permissions($PermissionLevels)
$Permissions | Add-Member NoteProperty GrantedThrough("Direct Permissions")
$PermissionCollection += $Permissions
}
}
#Export Permissions to CSV File
$PermissionCollection | Export-CSV $ReportFile -NoTypeInformation -Append
}
#Function to get sharepoint online site permissions report
Function Generate-PnPSitePermissionRpt()
{
[cmdletbinding()]
Param
(
[Parameter(Mandatory=$false)] [String] $SiteURL,
[Parameter(Mandatory=$false)] [String] $ReportFile,
[Parameter(Mandatory=$false)] [switch] $Recursive,
[Parameter(Mandatory=$false)] [switch] $ScanItemLevel,
[Parameter(Mandatory=$false)] [switch] $IncludeInheritedPermissions
)
Try {
#Connect to the Site
Connect-PnPOnline -URL $SiteURL -Interactive
#Get the Web
$Web = Get-PnPWeb
Write-host -f Yellow "Getting Site Collection Administrators..."
#Get Site Collection Administrators
$SiteAdmins = Get-PnPSiteCollectionAdmin
$SiteCollectionAdmins = ($SiteAdmins | Select -ExpandProperty Title) -join ","
#Add the Data to Object
$Permissions = New-Object PSObject
$Permissions | Add-Member NoteProperty Object("Site Collection")
$Permissions | Add-Member NoteProperty Title($Web.Title)
$Permissions | Add-Member NoteProperty URL($Web.URL)
$Permissions | Add-Member NoteProperty HasUniquePermissions("TRUE")
$Permissions | Add-Member NoteProperty Users($SiteCollectionAdmins)
$Permissions | Add-Member NoteProperty Type("Site Collection Administrators")
$Permissions | Add-Member NoteProperty Permissions("Site Owner")
$Permissions | Add-Member NoteProperty GrantedThrough("Direct Permissions")
#Export Permissions to CSV File
$Permissions | Export-CSV $ReportFile -NoTypeInformation
#Function to Get Permissions of All List Items of a given List
Function Get-PnPListItemsPermission([Microsoft.SharePoint.Client.List]$List)
{
Write-host -f Yellow "`t `t Getting Permissions of List Items in the List:"$List.Title
#Get All Items from List in batches
$ListItems = Get-PnPListItem -List $List -PageSize 500
$ItemCounter = 0
#Loop through each List item
ForEach($ListItem in $ListItems)
{
#Get Objects with Unique Permissions or Inherited Permissions based on 'IncludeInheritedPermissions' switch
If($IncludeInheritedPermissions)
{
Get-PnPPermissions -Object $ListItem
}
Else
{
#Check if List Item has unique permissions
$HasUniquePermissions = Get-PnPProperty -ClientObject $ListItem -Property HasUniqueRoleAssignments
If($HasUniquePermissions -eq $True)
{
#Call the function to generate Permission report
Get-PnPPermissions -Object $ListItem
}
}
$ItemCounter++
Write-Progress -PercentComplete ($ItemCounter / ($List.ItemCount) * 100) -Activity "Processing Items $ItemCounter of $($List.ItemCount)" -Status "Searching Unique Permissions in List Items of '$($List.Title)'"
}
}
#Function to Get Permissions of all lists from the given web
Function Get-PnPListPermission([Microsoft.SharePoint.Client.Web]$Web)
{
#Get All Lists from the web
$Lists = Get-PnPProperty -ClientObject $Web -Property Lists
#Exclude system lists
$ExcludedLists = @("Access Requests","App Packages","appdata","appfiles","Apps in Testing","Cache Profiles","Composed Looks","Content and Structure Reports","Content type publishing error log","Converted Forms",
"Device Channels","Form Templates","fpdatasources","Get started with Apps for Office and SharePoint","List Template Gallery", "Long Running Operation Status","Maintenance Log Library", "Images", "site collection images"
,"Master Docs","Master Page Gallery","MicroFeed","NintexFormXml","Quick Deploy Items","Relationships List","Reusable Content","Reporting Metadata", "Reporting Templates", "Search Config List","Site Assets","Preservation Hold Library",
"Site Pages", "Solution Gallery","Style Library","Suggested Content Browser Locations","Theme Gallery", "TaxonomyHiddenList","User Information List","Web Part Gallery","wfpub","wfsvc","Workflow History","Workflow Tasks", "Pages")
$Counter = 0
#Get all lists from the web
ForEach($List in $Lists)
{
#Exclude System Lists
If($List.Hidden -eq $False -and $ExcludedLists -notcontains $List.Title)
{
$Counter++
Write-Progress -PercentComplete ($Counter / ($Lists.Count) * 100) -Activity "Exporting Permissions from List '$($List.Title)' in $($Web.URL)" -Status "Processing Lists $Counter of $($Lists.Count)"
#Get Item Level Permissions if 'ScanItemLevel' switch present
If($ScanItemLevel)
{
#Get List Items Permissions
Get-PnPListItemsPermission -List $List
}
#Get Lists with Unique Permissions or Inherited Permissions based on 'IncludeInheritedPermissions' switch
If($IncludeInheritedPermissions)
{
Get-PnPPermissions -Object $List
}
Else
{
#Check if List has unique permissions
$HasUniquePermissions = Get-PnPProperty -ClientObject $List -Property HasUniqueRoleAssignments
If($HasUniquePermissions -eq $True)
{
#Call the function to check permissions
Get-PnPPermissions -Object $List
}
}
}
}
}
#Function to Get Webs's Permissions from given URL
Function Get-PnPWebPermission([Microsoft.SharePoint.Client.Web]$Web)
{
#Call the function to Get permissions of the web
Write-host -f Yellow "Getting Permissions of the Web: $($Web.URL)..."
Get-PnPPermissions -Object $Web
#Get List Permissions
Write-host -f Yellow "`t Getting Permissions of Lists and Libraries..."
Get-PnPListPermission($Web)
#Recursively get permissions from all sub-webs based on the "Recursive" Switch
If($Recursive)
{
#Get Subwebs of the Web
$Subwebs = Get-PnPProperty -ClientObject $Web -Property Webs
#Iterate through each subsite in the current web
Foreach ($Subweb in $web.Webs)
{
#Get Webs with Unique Permissions or Inherited Permissions based on 'IncludeInheritedPermissions' switch
If($IncludeInheritedPermissions)
{
Get-PnPWebPermission($Subweb)
}
Else
{
#Check if the Web has unique permissions
$HasUniquePermissions = Get-PnPProperty -ClientObject $SubWeb -Property HasUniqueRoleAssignments
#Get the Web's Permissions
If($HasUniquePermissions -eq $true)
{
#Call the function recursively
Get-PnPWebPermission($Subweb)
}
}
}
}
}
#Call the function with RootWeb to get site collection permissions
Get-PnPWebPermission $Web
Write-host -f Green "`n*** Site Permission Report Generated Successfully!***"
}
Catch {
write-host -f Red "Error Generating Site Permission Report!" $_.Exception.Message
}
}
#region ***Parameters***
$SiteURL="https://crescent.sharepoint.com/sites/marketing"
$ReportFile="C:\Temp\SitePermissionRpt.csv"
#endregion
#Call the function to generate permission report
Generate-PnPSitePermissionRpt -SiteURL $SiteURL -ReportFile $ReportFile -Recursive
#Generate-PnPSitePermissionRpt -SiteURL $SiteURL -ReportFile $ReportFile -Recursive -ScanItemLevel -IncludeInheritedPermissions
此 PowerShell 脚本获取 SharePoint Online 网站和子网站权限。这是该脚本生成的权限报告：
![[玩转系统] SharePoint Online：使用 PnP PowerShell 的网站集的用户权限审核报告](https://cn.a-d.site/common-images/sharepoint-online-user-permissions-audit-report-using-pnp-powershell/sharepoint-online-permission-report-using-PnP-PowerShell.png)
用于生成 SharePoint Online 网站权限报告的 PowerShell 脚本
虽然上述脚本可以达到目的，但如果您只想在权限报告中包含最多文件夹而不列出项目或文件，该怎么办？换句话说，当您使用 -scanitemlevel 开关处理较大的列表和库时，上述脚本会花费大量时间。
#Function to Get Permissions Applied on a particular Object, such as: Web, List or Folder
Function Get-PnPPermissions([Microsoft.SharePoint.Client.SecurableObject]$Object)
{
#Determine the type of the object
Switch($Object.TypedObject.ToString())
{
"Microsoft.SharePoint.Client.Web" { $ObjectType = "Site" ; $ObjectURL = $Object.URL; $ObjectTitle = $Object.Title }
"Microsoft.SharePoint.Client.ListItem"
{
$ObjectType = "Folder"
#Get the URL of the Folder
$Folder = Get-PnPProperty -ClientObject $Object -Property Folder
$ObjectTitle = $Object.Folder.Name
$ObjectURL = $("{0}{1}" -f $Web.Url.Replace($Web.ServerRelativeUrl,''),$Object.Folder.ServerRelativeUrl)
}
Default
{
$ObjectType = $Object.BaseType #List, DocumentLibrary, etc
$ObjectTitle = $Object.Title
#Get the URL of the List or Library
$RootFolder = Get-PnPProperty -ClientObject $Object -Property RootFolder
$ObjectURL = $("{0}{1}" -f $Web.Url.Replace($Web.ServerRelativeUrl,''), $RootFolder.ServerRelativeUrl)
}
}
#Get permissions assigned to the object
Get-PnPProperty -ClientObject $Object -Property HasUniqueRoleAssignments, RoleAssignments
#Check if Object has unique permissions
$HasUniquePermissions = $Object.HasUniqueRoleAssignments
#Loop through each permission assigned and extract details
$PermissionCollection = @()
Foreach($RoleAssignment in $Object.RoleAssignments)
{
#Get the Permission Levels assigned and Member
Get-PnPProperty -ClientObject $RoleAssignment -Property RoleDefinitionBindings, Member
#Get the Principal Type: User, SP Group, AD Group
$PermissionType = $RoleAssignment.Member.PrincipalType
#Get the Permission Levels assigned
$PermissionLevels = $RoleAssignment.RoleDefinitionBindings | Select -ExpandProperty Name
#Remove Limited Access
$PermissionLevels = ($PermissionLevels | Where { $_ -ne "Limited Access"}) -join "; "
#Leave Principals with no Permissions assigned
If($PermissionLevels.Length -eq 0) {Continue}
#Check if the Principal is SharePoint group
If($PermissionType -eq "SharePointGroup")
{
#Get Group Members
$GroupMembers = Get-PnPGroupMember -Identity $RoleAssignment.Member.LoginName
#Leave Empty Groups
If($GroupMembers.count -eq 0){Continue}
$GroupUsers = ($GroupMembers | Select -ExpandProperty Title | Where { $_ -ne "System Account"}) -join "; "
If($GroupUsers.Length -eq 0) {Continue}
#Add the Data to Object
$Permissions = New-Object PSObject
$Permissions | Add-Member NoteProperty Object($ObjectType)
$Permissions | Add-Member NoteProperty Title($ObjectTitle)
$Permissions | Add-Member NoteProperty URL($ObjectURL)
$Permissions | Add-Member NoteProperty HasUniquePermissions($HasUniquePermissions)
$Permissions | Add-Member NoteProperty Users($GroupUsers)
$Permissions | Add-Member NoteProperty Type($PermissionType)
$Permissions | Add-Member NoteProperty Permissions($PermissionLevels)
$Permissions | Add-Member NoteProperty GrantedThrough("SharePoint Group: $($RoleAssignment.Member.LoginName)")
$PermissionCollection += $Permissions
}
Else #User
{
#Add the Data to Object
$Permissions = New-Object PSObject
$Permissions | Add-Member NoteProperty Object($ObjectType)
$Permissions | Add-Member NoteProperty Title($ObjectTitle)
$Permissions | Add-Member NoteProperty URL($ObjectURL)
$Permissions | Add-Member NoteProperty HasUniquePermissions($HasUniquePermissions)
$Permissions | Add-Member NoteProperty Users($RoleAssignment.Member.Title)
$Permissions | Add-Member NoteProperty Type($PermissionType)
$Permissions | Add-Member NoteProperty Permissions($PermissionLevels)
$Permissions | Add-Member NoteProperty GrantedThrough("Direct Permissions")
$PermissionCollection += $Permissions
}
}
#Export Permissions to CSV File
$PermissionCollection | Export-CSV $ReportFile -NoTypeInformation -Append
}
#Function to get sharepoint online site permissions report
Function Generate-PnPSitePermissionRpt()
{
[cmdletbinding()]
Param
(
[Parameter(Mandatory=$false)] [String] $SiteURL,
[Parameter(Mandatory=$false)] [String] $ReportFile,
[Parameter(Mandatory=$false)] [switch] $Recursive,
[Parameter(Mandatory=$false)] [switch] $ScanFolders,
[Parameter(Mandatory=$false)] [switch] $IncludeInheritedPermissions
)
Try {
#Connect to the Site
Connect-PnPOnline -URL $SiteURL -Interactive
#Get the Web
$Web = Get-PnPWeb
Write-host -f Yellow "Getting Site Collection Administrators..."
#Get Site Collection Administrators
$SiteAdmins = Get-PnPSiteCollectionAdmin
$SiteCollectionAdmins = ($SiteAdmins | Select -ExpandProperty Title) -join "; "
#Add the Data to Object
$Permissions = New-Object PSObject
$Permissions | Add-Member NoteProperty Object("Site Collection")
$Permissions | Add-Member NoteProperty Title($Web.Title)
$Permissions | Add-Member NoteProperty URL($Web.URL)
$Permissions | Add-Member NoteProperty HasUniquePermissions("TRUE")
$Permissions | Add-Member NoteProperty Users($SiteCollectionAdmins)
$Permissions | Add-Member NoteProperty Type("Site Collection Administrators")
$Permissions | Add-Member NoteProperty Permissions("Site Owner")
$Permissions | Add-Member NoteProperty GrantedThrough("Direct Permissions")
#Export Permissions to CSV File
$Permissions | Export-CSV $ReportFile -NoTypeInformation
#Function to Get Permissions of Folders in a given List
Function Get-PnPFolderPermission([Microsoft.SharePoint.Client.List]$List)
{
Write-host -f Yellow "`t `t Getting Permissions of Folders in the List:"$List.Title
#Get All Folders from List
$ListItems = Get-PnPListItem -List $List -PageSize 2000
$Folders = $ListItems | Where { ($_.FileSystemObjectType -eq "Folder") -and ($_.FieldValues.FileLeafRef -ne "Forms") -and (-Not($_.FieldValues.FileLeafRef.StartsWith("_")))}
$ItemCounter = 0
#Loop through each Folder
ForEach($Folder in $Folders)
{
#Get Objects with Unique Permissions or Inherited Permissions based on 'IncludeInheritedPermissions' switch
If($IncludeInheritedPermissions)
{
Get-PnPPermissions -Object $Folder
}
Else
{
#Check if Folder has unique permissions
$HasUniquePermissions = Get-PnPProperty -ClientObject $Folder -Property HasUniqueRoleAssignments
If($HasUniquePermissions -eq $True)
{
#Call the function to generate Permission report
Get-PnPPermissions -Object $Folder
}
}
$ItemCounter++
Write-Progress -PercentComplete ($ItemCounter / ($Folders.Count) * 100) -Activity "Getting Permissions of Folders in List '$($List.Title)'" -Status "Processing Folder '$($Folder.FieldValues.FileLeafRef)' at '$($Folder.FieldValues.FileRef)' ($ItemCounter of $($Folders.Count))" -Id 2 -ParentId 1
}
}
#Function to Get Permissions of all lists from the given web
Function Get-PnPListPermission([Microsoft.SharePoint.Client.Web]$Web)
{
#Get All Lists from the web
$Lists = Get-PnPProperty -ClientObject $Web -Property Lists
#Exclude system lists
$ExcludedLists = @("Access Requests","App Packages","appdata","appfiles","Apps in Testing","Cache Profiles","Composed Looks","Content and Structure Reports","Content type publishing error log","Converted Forms",
"Device Channels","Form Templates","fpdatasources","Get started with Apps for Office and SharePoint","List Template Gallery", "Long Running Operation Status","Maintenance Log Library", "Images", "site collection images"
,"Master Docs","Master Page Gallery","MicroFeed","NintexFormXml","Quick Deploy Items","Relationships List","Reusable Content","Reporting Metadata", "Reporting Templates", "Search Config List","Site Assets","Preservation Hold Library",
"Site Pages", "Solution Gallery","Style Library","Suggested Content Browser Locations","Theme Gallery", "TaxonomyHiddenList","User Information List","Web Part Gallery","wfpub","wfsvc","Workflow History","Workflow Tasks", "Pages")
$Counter = 0
#Get all lists from the web
ForEach($List in $Lists)
{
#Exclude System Lists
If($List.Hidden -eq $False -and $ExcludedLists -notcontains $List.Title)
{
$Counter++
Write-Progress -PercentComplete ($Counter / ($Lists.Count) * 100) -Activity "Exporting Permissions from List '$($List.Title)' in $($Web.URL)" -Status "Processing Lists $Counter of $($Lists.Count)" -Id 1
#Get Item Level Permissions if 'ScanFolders' switch present
If($ScanFolders)
{
#Get Folder Permissions
Get-PnPFolderPermission -List $List
}
#Get Lists with Unique Permissions or Inherited Permissions based on 'IncludeInheritedPermissions' switch
If($IncludeInheritedPermissions)
{
Get-PnPPermissions -Object $List
}
Else
{
#Check if List has unique permissions
$HasUniquePermissions = Get-PnPProperty -ClientObject $List -Property HasUniqueRoleAssignments
If($HasUniquePermissions -eq $True)
{
#Call the function to check permissions
Get-PnPPermissions -Object $List
}
}
}
}
}
#Function to Get Webs's Permissions from given URL
Function Get-PnPWebPermission([Microsoft.SharePoint.Client.Web]$Web)
{
#Call the function to Get permissions of the web
Write-host -f Yellow "Getting Permissions of the Web: $($Web.URL)..."
Get-PnPPermissions -Object $Web
#Get List Permissions
Write-host -f Yellow "`t Getting Permissions of Lists and Libraries..."
Get-PnPListPermission($Web)
#Recursively get permissions from all sub-webs based on the "Recursive" Switch
If($Recursive)
{
#Get Subwebs of the Web
$Subwebs = Get-PnPProperty -ClientObject $Web -Property Webs
#Iterate through each subsite in the current web
Foreach ($Subweb in $web.Webs)
{
#Get Webs with Unique Permissions or Inherited Permissions based on 'IncludeInheritedPermissions' switch
If($IncludeInheritedPermissions)
{
Get-PnPWebPermission($Subweb)
}
Else
{
#Check if the Web has unique permissions
$HasUniquePermissions = Get-PnPProperty -ClientObject $SubWeb -Property HasUniqueRoleAssignments
#Get the Web's Permissions
If($HasUniquePermissions -eq $true)
{
#Call the function recursively
Get-PnPWebPermission($Subweb)
}
}
}
}
}
#Call the function with RootWeb to get site collection permissions
Get-PnPWebPermission $Web
Write-host -f Green "`n*** Site Permission Report Generated Successfully!***"
}
Catch {
write-host -f Red "Error Generating Site Permission Report!" $_.Exception.Message
}
}
#region ***Parameters***
$SiteURL="https://crescent.sharepoint.com/sites/legal/"
$ReportFile="C:\Temp\Legal-SitePermissionRpt.csv"
#endregion
#Call the function to generate permission report
Generate-PnPSitePermissionRpt -SiteURL $SiteURL -ReportFile $ReportFile -ScanFolders
#Generate-PnPSitePermissionRpt -SiteURL $SiteURL -ReportFile $ReportFile -Recursive -ScanFolders -IncludeInheritedPermissions
使用“-Recursive”开关通过 PowerShell 获取 SharePoint Online 网站和子网站权限。此报告有助于审核站点权限并确保只有授权用户才能访问敏感信息。
如何为租户中的所有网站集生成报告？
我们可以为租户中的所有站点调用该函数并生成站点的权限报告：
#Connect to Admin Center
$TenantAdminURL = "https://crescent-admin.SharePoint.com"
$Cred = Get-Credential
Connect-PnPOnline -Url $TenantAdminURL -Credentials $Cred
#Get All Site collections - Exclude: Seach Center, Redirect site, Mysite Host, App Catalog, Content Type Hub, eDiscovery and Bot Sites
$SitesCollections = Get-PnPTenantSite | Where -Property Template -NotIn ("SRCHCEN#0","REDIRECTSITE#0", "SPSMSITEHOST#0", "APPCATALOG#0", "POINTPUBLISHINGHUB#0", "EDISC#0", "STS#-1")
#Loop through each site collection
ForEach($Site in $SitesCollections)
{
#Connect to site collection
$SiteConn = Connect-PnPOnline -Url $Site.Url -Credentials $Cred
Write-host "Generating Report for Site:"$Site.Url
#Call the Function for site collection
$ReportFile = "C:\Temp$($Site.URL.Replace('https://','').Replace('/','_')).CSV"
Generate-PnPSitePermissionRpt -SiteURL $Site.URL -ReportFile $ReportFile -Recursive
}
将 #Region *** 参数 *** 替换为上述脚本，为租户中的所有站点生成报告。
结论
总之，使用 PowerShell 在 SharePoint Online 中创建权限报告可以成为管理和监控内容访问的强大而有效的方法。通过使用 PnP PowerShell 模块提供的 cmdlet，您可以自动生成报告的过程，并快速识别站点和内容权限中的任何问题或不一致。此外，PowerShell 脚本可以安排定期运行，因此您可以获得定期更新的报告。通过此报告，您可以确保您的 SharePoint Online 环境安全，并且用户拥有对其所需内容的适当访问权限。
猜你还喜欢
- 03-30 [玩转系统] 如何用批处理实现关机，注销，重启和锁定计算机
- 02-14 [系统故障] Win10下报错：该文件没有与之关联的应用来执行该操作
- 01-07 [系统问题] Win10--解决锁屏后会断网的问题
- 01-02 [系统技巧] Windows系统如何关闭防火墙保姆式教程，超详细
- 12-15 [玩转系统] 如何在 Windows 10 和 11 上允许多个 RDP 会话
- 12-15 [玩转系统] 查找 Exchange/Microsoft 365 中不活动（未使用）的通讯组列表
- 12-15 [玩转系统] 如何在 Windows 上安装远程服务器管理工具 (RSAT)
- 12-15 [玩转系统] 如何在 Windows 上重置组策略设置
- 12-15 [玩转系统] 如何获取计算机上的本地管理员列表？
- 12-15 [玩转系统] 在 Visual Studio Code 中连接到 MS SQL Server 数据库
- 12-15 [玩转系统] 如何降级 Windows Server 版本或许可证
- 12-15 [玩转系统] 如何允许非管理员用户在 Windows 中启动/停止服务
您需要 登录账户 后才能发表评论
取消回复欢迎 你 发表评论:
- 精品推荐！
-
- 最新文章
- 热门文章
- 热评文章
![[影视] 黑道中人 Alto Knights（2025）剧情 犯罪 历史 电影](https://www.cdz432.com/zb_users/upload/2025/06/20250605164418174911305823566.jpeg)
[影视] 黑道中人 Alto Knights（2025）剧情 犯罪 历史 电影
![[古装剧] [七侠五义][全75集][WEB-MP4/76G][国语无字][1080P][焦恩俊经典]](https://www.cdz432.com/zb_users/upload/2025/06/20250605162958174911219826273.png)
[古装剧] [七侠五义][全75集][WEB-MP4/76G][国语无字][1080P][焦恩俊经典]
![[实用软件] 虚拟手机号 电话 验证码 注册](https://www.cdz432.com/zb_users/upload/2024/12/20241220032433173463627337077.png)
[实用软件] 虚拟手机号 电话 验证码 注册
![[电视剧] 安眠书店/你 第五季 You Season 5 (2025) 【全10集】](https://www.cdz432.com/zb_users/upload/2025/06/20250605132041174910084178877.jpeg)
[电视剧] 安眠书店/你 第五季 You Season 5 (2025) 【全10集】
![[电视剧] 棋士(2025) 4K 1080P【全22集】悬疑 犯罪 王宝强 陈明昊](https://www.cdz432.com/zb_users/upload/2025/06/20250605054129174907328926586.png)
[电视剧] 棋士(2025) 4K 1080P【全22集】悬疑 犯罪 王宝强 陈明昊
![[软件合集] 25年6月5日 精选软件22个](https://www.cdz432.com/zb_users/upload/2025/06/20250605021254174906077434837.jpeg)
[软件合集] 25年6月5日 精选软件22个
![[软件合集] 25年6月4日 精选软件36个](https://www.cdz432.com/zb_users/upload/2025/06/20250605012235174905775585667.jpeg)
[软件合集] 25年6月4日 精选软件36个
![[短剧] 2025年06月04日 精选+付费短剧推荐33部](https://www.cdz432.com/zb_users/upload/2025/06/20250605011208174905712871353.jpeg)
[短剧] 2025年06月04日 精选+付费短剧推荐33部
![[短剧] 2025年06月03日 精选+付费短剧推荐25部](https://www.cdz432.com/zb_users/upload/2025/06/20250603101336174891681667656.jpeg)
[短剧] 2025年06月03日 精选+付费短剧推荐25部
![[软件合集] 25年6月3日 精选软件44个](https://www.helloimg.com/i/2025/06/03/683de4640b19f.jpg)
[软件合集] 25年6月3日 精选软件44个
![[剧集] [央视][笑傲江湖][2001][DVD-RMVB][高清][40集全]李亚鹏、许晴、苗乙乙](https://www.cdz432.com/content/uploadfile/201803/c3d3e01ab26bb2735eaf524e713ec89720180316073712.jpg)
[剧集] [央视][笑傲江湖][2001][DVD-RMVB][高清][40集全]李亚鹏、许晴、苗乙乙
![[电视剧] 欢乐颂.5部全 (2016-2024)](https://www.cdz432.com/zb_users/upload/2025/04/20250406192949174393898913565.png)
[电视剧] 欢乐颂.5部全 (2016-2024)
![[电视剧] [突围] [45集全] [WEB-MP4/每集1.5GB] [国语/内嵌中文字幕] [4K-2160P] [无水印]](https://www.cdz432.com/zb_users/upload/2022/08/20220817004618166066837857366.jpeg)
[电视剧] [突围] [45集全] [WEB-MP4/每集1.5GB] [国语/内嵌中文字幕] [4K-2160P] [无水印]
![[影视] 【稀有资源】香港老片 艺坛照妖镜之96应召名册 (1996)](https://www.cdz432.com/zb_users/upload/2025/03/20250327032528174301712835919.jpeg)
[影视] 【稀有资源】香港老片 艺坛照妖镜之96应召名册 (1996)
![[剧集] 神经风云(2023)（完结）.4K](https://www.cdz432.com/zb_users/upload/2023/02/20230228154344167757022486307.jpeg)
[剧集] 神经风云(2023)（完结）.4K
![[剧集] [BT] [TVB] [黑夜彩虹(2003)] [全21集] [粤语中字] [TV-RMVB]](https://www.cdz432.com/zb_users/upload/2023/08/20230808013412169142965225465.jpeg)
[剧集] [BT] [TVB] [黑夜彩虹(2003)] [全21集] [粤语中字] [TV-RMVB]
[实用软件] 虚拟手机号 电话 验证码 注册
![[资源] B站充电视频合集，包含多位重量级up主，全是大佬真金白银买来的～【99GB】](https://www.cdz432.com/zb_users/upload/2025/03/20250313140427174184586786232.png)
[资源] B站充电视频合集，包含多位重量级up主，全是大佬真金白银买来的～【99GB】
![[影视] 内地绝版高清录像带 [mpg]](https://www.cdz432.com/zb_users/upload/2025/03/20250321021320174249440088196.png)
[影视] 内地绝版高清录像带 [mpg]
![[书籍] 古今奇书禁书三教九流资料大合集 猎奇必备珍藏资源PDF版 1.14G](https://www.cdz432.com/zb_users/upload/2025/03/20250323003107174266106731624.jpeg)
[书籍] 古今奇书禁书三教九流资料大合集 猎奇必备珍藏资源PDF版 1.14G
[电视剧] [突围] [45集全] [WEB-MP4/每集1.5GB] [国语/内嵌中文字幕] [4K-2160P] [无水印]
[剧集] [央视][笑傲江湖][2001][DVD-RMVB][高清][40集全]李亚鹏、许晴、苗乙乙
![[电影] 美国队长4 4K原盘REMUX 杜比视界 内封简繁英双语字幕 49G](https://www.cdz432.com/zb_users/upload/2025/05/20250515035917174725275733470.webp)
[电影] 美国队长4 4K原盘REMUX 杜比视界 内封简繁英双语字幕 49G
![[电影] 死神来了（1-6）大合集！](https://www.cdz432.com/zb_users/upload/2025/05/20250515034452174725189233169.png)
[电影] 死神来了（1-6）大合集！
![[软件合集] 25年05月13日 精选软件16个](https://www.helloimg.com/i/2025/05/13/68236aed7fc51.png)
[软件合集] 25年05月13日 精选软件16个
![[精品软件] 25年05月15日 精选软件18个](https://www.cdz432.com/zb_users/upload/2025/05/20250515160506174729630629160.jpeg)
[精品软件] 25年05月15日 精选软件18个
![[绝版资源] 南与北 第1-2季 合集 North and South (1985) /美国/豆瓣: 8.8[1080P][中文字幕]](https://www.cdz432.com/zb_users/upload/2025/05/20250515004208174724092867596.jpeg)
[绝版资源] 南与北 第1-2季 合集 North and South (1985) /美国/豆瓣: 8.8[1080P][中文字幕]
![[软件] 25年05月14日 精选软件57个](https://www.cdz432.com/zb_users/upload/2025/05/20250515041136174725349694202.png)
[软件] 25年05月14日 精选软件57个
![[短剧] 2025年05月14日 精选+付费短剧推荐39部](https://www.cdz432.com/zb_users/upload/2025/05/20250515041958174725399856346.png)
[短剧] 2025年05月14日 精选+付费短剧推荐39部
![[短剧] 2025年05月15日 精选+付费短剧推荐36部](https://www.cdz432.com/zb_users/upload/2025/05/20250515042624174725438494583.png)
[短剧] 2025年05月15日 精选+付费短剧推荐36部
- 最新评论
-
- 热门tag