How to find libraries with unique permissions in SharePoint Online

Before you start

Use an account that can open the site, such as its site collection administrator. PnP PowerShell needs PowerShell 7.4 or later; it doesn't run in Windows PowerShell 5.1. Since September 2024 an interactive PnP PowerShell sign-in needs your own app registration in Microsoft Entra ID, passed as -ClientId; PnP's documentation registers one with Register-PnPEntraIDApp.

The property is read live, for the libraries at the top of the site you name, not those in subsites. It says whether the library itself has its own permissions, not whether a folder or file inside it does. Hidden libraries are left out. The examples read and export and change nothing.

Option 1

Find libraries with unique permissions with PowerShell

Install the module once, then connect to the site, read its lists with the property and keep the document libraries. Replace the site address and the client ID with your own.

# Install once, if the module is not already installed.
Install-Module PnP.PowerShell -Scope CurrentUser

$ErrorActionPreference = 'Stop'
$siteUrl = 'https://contoso.sharepoint.com/sites/research'
$clientId = '00000000-0000-0000-0000-000000000000'
Connect-PnPOnline -Url $siteUrl -Interactive -ClientId $clientId
try {
    $lists = @(Get-PnPList -Includes HasUniqueRoleAssignments)
    # 101 is the document library template.
    $report = @($lists | Where-Object { $_.BaseTemplate -eq 101 -and -not $_.Hidden } |
        Sort-Object Title | ForEach-Object {
            [pscustomobject]@{
                Library = $_.Title
                Items = $_.ItemCount
                OwnPermissions = $_.HasUniqueRoleAssignments
            }
        })
    if ($report.Count -eq 0) {
        Write-Output "No document library was found on $siteUrl."
    } else {
        $report | Export-Csv -Path './library-permissions.csv' -NoTypeInformation -Encoding utf8
        $own = @($report | Where-Object { $_.OwnPermissions }).Count
        Write-Output "$own of $($report.Count) libraries on $siteUrl have their own permissions."
    }
} finally {
    Disconnect-PnPOnline
}

The CSV has 1 row for each visible document library on the site, with its number of items and whether it has its own permissions. To check another site, change $siteUrl and run it again. To include lists as well as libraries, remove the BaseTemplate test.

Option 2

Count unique permissions in the SharePoint admin centre

1. Sign in to the SharePoint admin centre as a SharePoint Administrator.
2. Expand Reports and select Data access governance.
3. Under Site permissions across your organization, select View reports, then Create report. Microsoft says the first report takes up to 5 days, later ones up to 24 hours, and a report can run again every 30 days.
4. When it's ready, select View report under SharePoint and download the CSV.
5. Sort the CSV by Items with unique permissions count to find the sites with the most broken inheritance.

This suits a tenant with SharePoint Advanced Management. It counts every item with unique permissions on each site, files and folders included, but doesn't name the libraries. For the libraries themselves, use PowerShell or a report.

Common questions

Why does Microsoft's report count more than the libraries found?

The site permissions report counts every item where inheritance was broken, so a single file shared with 1 person counts. A library's own flag says only whether the library as a whole has its own permissions.

Why didn't adding someone to the site's members reach a library?

The library has its own permissions, so it doesn't take the site's. Check the library's own permissions, or add the person there.

Can I check version limits at the same time?

Yes, the same libraries report both. See how to check library version limits in SharePoint Online.