📋 GRC compliance for CMMC 2.0, CPCSC, CPA Canada, IIROC…SaaS discovery for data governanceFree enriched web chat widget🚀 Enriched remote support without your laptop

Access Review

See who can reach every SharePoint site, Team, folder and mailbox in your Microsoft 365 tenant, and approve or deny each grant.

Where to find it
Microsoft 365 › Access Review
Who can use it
Users with the Access Review permission (view); approving, denying and flagging need the approve permission; removing access in Microsoft 365 needs the remove permission and must be allowed for the company
Plan
Access Review add-on
For
Everyone

What the page is for

Access in Microsoft 365 builds up over time: people join Teams, files get shared with guests, and mailbox delegates and forwarding rules get added and forgotten. Access Review brings all of that into one place so you can check it regularly.

The page shows your SharePoint sites and Teams and who has access to each, the files and folders that have their own permissions instead of inheriting from the site, every guest with their invitation state and last activity, mailbox delegation and forwarding, and a list of grants waiting for a decision. You can look at access from a site's point of view or from a person's point of view.

Reviewers can approve, deny or flag each grant. Where your organization allows it, an administrator can also queue removal of a grant directly in Microsoft 365. Data comes from your connected Microsoft 365 tenant; the time of the last sync is shown at the top of the page.

What you see

The Access Review page, with the export report, summary tiles, tabs, filters and results table numbered 1 to 5.
The Access Review page. Numbers match the list below.
  1. Export Report: opens a printable access review report in a new tab. The last sync time is shown alongside.
  2. Summary tiles: Sites, Teams, Guests, Items w/ unique access and Pending approvals.
  3. Tabs: Overview, People, Granular, Guests, Mailboxes and Approvals.
  4. Filters: Search, Resource (a site or Team), Guests only and Apply.
  5. Results table: changes with the tab. For example, Overview shows Resource, Type, Who has access and Guests; Approvals shows Resource, Principal, Access, Guest, Status and Action.

How to see who has access to a site or Team

  1. Open the Overview tab.
  2. Find the site in the list, or pick it in Resource and click Apply.
  3. Check the Type badge: Team site, SharePoint site or OneDrive.
  4. Click the row to expand it and see the site's SharePoint groups (Owners, Members, Visitors) and the members of its backing group.

How to see everything one person can reach

  1. Open the People tab.
  2. Search for the person and click their name.
  3. Review their direct file and folder grants, sites reachable through group membership, Team memberships, group memberships and mailbox access.
  4. Click All people to go back.

How to review files and folders with their own permissions

  1. Open the Granular tab.
  2. Optionally choose a site in Resource and click Apply.
  3. Review each folder or file listed. Only items whose permissions differ from their parent are shown; items that simply inherit are not listed.

How to review guests and mailboxes

  1. Open the Guests tab to see each guest's Email / UPN, State, Invited by, Last login and Last access. A not accepted badge means the guest never accepted the invitation.
  2. Open the Mailboxes tab to see Shared mailboxes, Delegation and Forwarding. Look for flags such as external delegate, external forwarding and keeps a copy in mailbox.

How to approve, deny or flag access

  1. Open the Approvals tab. Tick Guests only to focus on guest access.
  2. For each grant, click the approve button, the deny button (you can enter an optional reason), or the flag button to mark it for an administrator to remove.
  3. If removal is enabled for your organization and you have permission, click the remove button and confirm to queue a real removal in Microsoft 365. It runs on the next collection cycle.

Tips

  • Start with Guests and Mailboxes: external guests who never signed in and forwarding to outside addresses are the most common findings.
  • Hover over badges and access levels for a plain-English explanation.
  • Use People before someone leaves the organization to see everything they can reach.
  • Use Access Certification when you want a formal sign-off of each user's access level to each Team and site.

Troubleshooting

  • "Microsoft 365 is not connected for this company." Connect Microsoft 365 first. Access data appears after the next collection.
  • "Access Review isn't enabled for this company." The add-on is not turned on in this company's subscription. Click Enable in billing.
  • "You don't have permission to view access reviews for this company." Ask an administrator to grant you the Access Review permission.
  • A site shows no Owners, Members or Visitors. The site's group information has not been collected yet. Check again after the next sync.
  • "No item-level access found." Every file and folder in scope inherits its site's permissions, so there is nothing extra to review.

Task guides that use this page

Still need help?

Search the support centre, or contact our support team and tell us which page you were on.

Names, companies, devices and figures in the pictures are examples. Other product and company names are trademarks of their respective owners.

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.