Who has access to what? One permissions report across every environment

The question arrives in one of three ways. Internal audit wants a list of who can open the apps that touch finance. Somebody has left and HR wants to know what they had. Or a Copilot roll-out has made oversharing everybody’s problem and the Power Platform estate is suddenly in scope.

All three are the same request: who has access to what, across every environment, in one file. It is a reasonable thing to ask for and a surprisingly awkward thing to produce.

Three reasons the obvious route does not work

It is per app, and you have hundreds

Sharing is a property of an app, and the surfaces that show it show one app at a time. That is fine for a question about one app. For a question about an estate it is hundreds of clicks and no file at the end.

A group counts as one

This is the one that makes a report wrong rather than slow. When an app is shared with a security group, the platform records one grant. A group of four hundred people and a single colleague are both “one share”.

A count of shares is therefore not a measure of exposure, and sorting apps by it will put the genuinely overshared app somewhere in the middle of the list. The number that means something is the number of people the grants actually reach, which means expanding every group.

Environments are separate worlds

Nothing joins them up. Each environment is enumerated on its own, and the default environment — usually the largest, usually the least governed — is just another row to be gathered. The report you want crosses all of them; the tooling is scoped to one.

What the report should contain

Having built a few of these, the columns that get used are narrower than the ones people ask for:

• App, environment, type, owner. The identity of the thing. Owner matters as much as the shares, because an owner has full control by definition.
• Shared with, split into users and groups. Not a single total — the split is what tells you whether to go and look.
• People reached. Groups expanded. This is the exposure figure.
• Shared with the whole tenant. A flag, not a number. It is a different kind of finding and burying it inside a count hides it.
• Permission level. Can-use and can-edit are not the same disclosure.
• What the app touches. The connectors and, where it can be resolved, the actual data sources — because “who can open it” is only half of “what did they have access to”.

Read sharing live, not from last week’s snapshot

Most of an inventory is stable. Apps do not change environment, flows do not change trigger, solutions do not change publisher. Sharing changes constantly — it is the single most volatile fact in the estate, because granting access is a thirty-second action available to every maker.

Which means a sharing report built from a stored assessment is reporting the past, and the gap between the scan and the question is exactly where a wrong answer lives. It is worth reading that one figure live even when everything around it comes from storage.

Give it to people who do not have a licence

The people who asked for this report — audit, risk, a department head, a client — generally cannot open the Power Platform admin centre and should not need to. Whatever produces the report has to produce a file.

In practice that is Excel for anyone who will filter it, PDF for anyone who will attach it to a paper, and CSV for whoever is going to join it to something else. Per app or across the estate, and the same export on every list rather than on some of them.

While you are there: the connections

An access review that stops at apps misses the other half. A connection is an identity, and a production flow running as a named individual is a standing grant of that person’s access to whatever the connector reaches — one that survives them changing role and stops working the day they leave.

The same report run over connections answers a question nobody asked but everybody should: which business processes are currently authenticating as a human being.

Make it repeatable, because it will be asked again

The thing that makes this painful is never the first request. It is the fourth, six months later, phrased slightly differently, when whoever built the first one has moved on and the spreadsheet is out of date.

A standing inventory you can refresh and re-export turns a two-day exercise into a two-minute one, which is the entire difference between a governance process that happens and one that is on a roadmap.

Power Insights governance reports ownership, sharing reach and premium exposure across every environment in the tenant, and exports any of it to Excel, PDF, CSV or JSON.