ShareScout audits SharePoint, OneDrive and Teams permissions read-only — Anyone links, sites open to every employee, stale guests, broken inheritance, ownerless sites, missing sensitivity labels — and ranks every site with a Copilot exposure score. One script, one report. Runs in your tenant. Nothing leaves it.
-SkipItemScan; a full item-level scan runs unattendedMicrosoft's own Data access governance snapshot needs SharePoint Advanced Management (it comes with a Copilot licence; otherwise a paid add-on). ShareScout gives you the snapshot on any plan — before you buy the first Copilot seat — as one portable report per tenant.
Every anonymous file and folder link: view or edit, when it was created, whether it ever expires. The ones with no expiry go first.
Everyone, Everyone except external users, All Users — in Owners, Members or Visitors, or on individual items. The single biggest Copilot-exposure lever.
Every guest per site and how they got in; last sign-in and stale-guest flag when Entra ID P1 is present.
Libraries, folders and items with unique permissions per site — where "who can see this" differs from the site and nobody reviews it.
Sites with no or one admin, Microsoft 365 groups with no owners — nobody to answer a site access review.
Unlabelled sites, and labelled sites whose sharing setting is looser than the label suggests.
One number up top, the evidence below, a remediation order at the end. Every site scored 0–100 and weighted by size, so the wide-open 50,000-item site outranks the wide-open empty one.
No SaaS sign-up, no tenant connection to a third party. You run it; the report stays with you.
Run the PowerShell script as a SharePoint admin. It signs in to Microsoft Graph and SharePoint with read-only, delegated scopes you consent to. ShareScout has no servers.
Tenant sharing settings, every site's groups and admins, guests, labels — then, optionally, every library for unique permissions and Anyone links. Each site gets an exposure score.
Open the HTML report + CSVs, work the remediation order (EEEU sites first, no-expiry links second), re-run monthly and track the top-20 weighted scores as your trend.
Buy it once, own it. Every comparable tool is a per-user subscription; ShareScout is a script and a report.
Instant download after checkout (Lemon Squeezy). One-time price, no subscription.
No. ShareScout is a script that runs inside your tenant against Microsoft Graph and your SharePoint. There is no ShareScout server and nothing is uploaded. The report is written to your own machine — and it contains guest addresses and file paths, so treat it as confidential.
A SharePoint Administrator account, read-only Graph scopes (User, Group, Directory, Sites, Organization — plus AuditLog for guest sign-in activity) and a one-time PnP.PowerShell app registration in your Entra ID with delegated permissions. The README has the five-line recipe. It never writes changes.
Those reports need SharePoint Advanced Management, which you get once at least one Copilot licence is assigned or as a paid add-on; E5 without Copilot gets 28-day activity reports only, and Business plans get nothing. ShareScout answers "how overshared are we" before the first Copilot seat is bought, on any plan, and produces one portable, scored report per tenant — which is what an MSP needs across clients.
Per site: +40 if Everyone / Everyone except external users has access, +30 if any Anyone link exists, +15 if guests have access, up to +15 for unique-permission items — capped at 100, then weighted by log10(items). The weights are in a CSV you can edit. It is a prioritisation heuristic, not a compliance verdict.
The tenant pass takes minutes. The optional item scan walks every library, but only items with unique permissions are inspected further, so well-inherited sites are fast. Start with -SkipItemScan, then scan the sites the first report names.
Never. It is strictly read-only and produces a report plus a remediation order. You decide what to action.
Yes — the Pro tier is licensed for unlimited client tenants and white-labels the report, built for consultants and MSPs doing Copilot-readiness work.
Run the free Lite audit today: the Anyone-link and open-site CSVs alone are usually enough to start a conversation.