CNX SharePoint Control+

The Overview tab gives the site a security score out of 100, rates its security posture from at risk to on track, and suggests what to do next. Key figures (findings, groups, people with access, external users, unique permissions and sharing links) sit next to the site's details, its storage use and a dashboard of charts that shows where access is concentrated.

The Findings tab lists each risk the assessment found, from critical to low: content open to everyone, Anyone links, external access, too many unique permissions, too many people with Full Control, orphaned users and empty groups. Select a finding to see its potential impact, the recommended action and every affected item. Each finding lowers the score: 25 points if it's critical, 15 if high, 8 if medium and 3 if low.

The Groups tab lists every group with access to the site (SharePoint groups, Microsoft 365 groups and security groups) with its permission levels and a risk rating. Open a group to see its owners and members, including the people in nested groups. You can create and delete SharePoint groups, add and remove their members and change their owner; Microsoft 365 and security groups are managed in Microsoft Entra ID, so they're shown read-only.

The Members tab shows everyone who can access the site, directly or through a group, with their effective access and a risk rating. Nested memberships are expanded, so you can see exactly how each person gets their access. Open a person to see every group they belong to on the site and anything granted to them directly.

The Permissions tab shows how permissions are set across the site: which lists and libraries (and, after a library scan, which folders and files) inherit their permissions and which have their own. Switch to the Inheritance map for a visual view. From here you can grant access, change permission levels, remove access, and stop or restore inheritance.

A Library scan looks below the site level, at the folders and files inside libraries and lists. It finds items with unique permissions, sharing links (including Anyone links, which open content without signing in) and stale permissions, such as unused links, empty groups and accounts that no longer exist. Each flagged item explains why it's flagged and what to do about it, and you can remove sharing links and stale permissions right from the results.

The Sites tab lists the sites in your tenant, with search, filters and favorites. Turn on Only sites I can manage to focus on the sites you can assess, then open a site's details, or its assessment, without leaving the page.

When Save each assessment is on, the History tab keeps a record of completed assessments, with their score, findings, unique permissions and external users. Select two assessments and then Compare selected to see how the score changed and why, and exactly which permissions were added, changed or removed.

Select Export to download the results as an Excel workbook, with a filterable sheet for each part of the assessment, or as a PDF report with the same information in a printable layout.

• To run an assessment, you need to be a site collection administrator, or to have both the Manage Permissions and Enumerate Permissions permissions on the site. Site owners have both through Full Control.
• To make changes, such as adding members or removing access, you need the Manage Permissions permission.
• Everyone else sees only the Sites tab, with an explanation of why.
• Usage figures in a site's details also need a role that can read usage reports, such as Reports Reader. Without one, site analytics are shown instead, and the panel says so.

• Assessments and library scans run in your browser, with your permissions. Keep the page open until they finish: if you leave, you're asked to confirm, and the work in progress is cancelled.
• A cancelled or failed library scan can't be resumed: scan the library again from the start.
• There's no background schedule, because SharePoint Online doesn't run web parts in the background. Auto reassess every (days) starts an assessment only when someone who can assess the site opens the page.

• The assessment takes about the same time whatever the number of files, because it reads lists and libraries, not the items in them. Folder and file permissions, and where sharing links point, appear after a library scan.
• A library scan reads every item, so it takes longer as libraries grow. Libraries are scanned one at a time, and the Progress column shows how far each scan has got.
• When SharePoint is busy, it slows down requests (throttling) and the web part retries them. If a library still can't be read, it's marked Failed and the scan moves on to the next one: scan it again later, ideally outside business hours.
• What slows things down most is the number of items with unique permissions, not the total number of items. Tens of thousands of them make the Permissions and Library scan tabs slow to open, sort and filter, and make exports slow.

• Saved assessments are kept in lists on the site whose names start with “Assessment-”. Only the site owners and the person who ran the assessment can read them. If the site has no owners group, the lists keep the site's permissions, so restrict them yourself.
• Saving a large assessment takes time and can be throttled: 20,000 items with unique permissions, each shared with five people or groups, make about 100,000 records. If some records can't be saved, a message explains why, and Save again completes the saved copy.
• A comparison reads up to 50,000 permission records from each assessment. Changes beyond that aren't shown.
• Older assessments that are no longer kept, and assessments you delete, go to the site recycle bin. They count against the site's storage until the recycle bin is emptied (after 93 days by default).

• Microsoft 365 and security groups: up to 10,000 members per group and 5 levels of nested groups are read, so counts for larger groups are minimums.
• Orphaned users: up to 150 people are checked in each assessment.
• Sharing links before a library scan: up to 1,000 shared files and folders are named. The others are listed by link only until their library is scanned.
• Sites tab: up to 200 sites are listed. In larger tenants, use the search box.
• Lists and groups: up to 5,000 lists and libraries, and 5,000 SharePoint groups, per site.
• Exports: Excel and PDF only. Each table in the PDF report shows up to 2,000 rows; the Excel workbook includes them all.