Initializing authentication...
Live File Results
Workplaces
Document Libraries
Shared Files & Folders
Shared User Drives
Personal Drive
Permission Center
Search for the person who needs access
Target:
Expand a site to see its SharePoint groups and document libraries. Folder browsing is lazy — expand a library to load its folders.
Search for the user to copy access from
Site-level (SharePoint group) access only — folder-level permissions aren't scanned live across the tenant since that would mean walking every folder of every site on each lookup. Uncheck anything you don't want to copy, then Apply.
Current site-level access
Live scan of SharePoint group membership across all sites — this can take a bit. Change their level, remove access, or copy/email the site link, right from each row.
Folder-level access
Finds every folder across all sites where this person has access — both classic SharePoint permissions and share links ("Share" → send a link) — so you don't have to browse for it. Checking both on every folder makes this noticeably heavier than the site-level scan above — it can take several minutes on a large tenant. Access this person only has through a SharePoint group (not a direct per-folder grant) won't show up here — that's covered by the site-level list above. Known gap: personal-OneDrive shares (someone else's folder shared directly with them, e.g. from their own "Shared Files & Folders") can't be checked from here — Microsoft Graph refuses to let anyone but that person read their own sharing inbox, confirmed by testing, not something this tool can work around.
Always granted
Every new hire gets these, regardless of department or location. This only applies to the person picked in step 1 — it never touches existing employees.
By department
By location
Delegate their OneDrive
Search for who should receive access to 's personal OneDrive. They'll get an email with a link, active for 90 days (Almex's data retention period for departed employees) — the link itself expires then, not just as a policy note.
Remove all their access
Scans and removes every site- and folder-level grant this person has — SharePoint groups, direct site grants, folder permissions, and share links. Same scan used elsewhere in this tool, so it can take several minutes on a large tenant. This does not disable their account or sign-in — that stays a separate step outside this tool.
Confidential access — approval required
This request touches at least one confidential site. It won't be applied until one of the three IT administrators reviews and approves it from Pending Approvals — nothing in this batch is granted yet.
My Team's Access
Your direct reports
Click someone to see their current SharePoint access, or grant them more from what you have access to.
Current site-level access
Folder-level access
Finds every folder across all sites where this person has access — both classic SharePoint permissions and share links. Checking both makes this slower than the site-level list above; can take a few minutes on a large tenant. Known gap: personal-OneDrive shares (someone else's folder shared directly with them) can't be checked here — Microsoft Graph refuses to let anyone but that person read their own sharing inbox.
Grant new access
Only shows things you yourself have access to — your own sites, libraries, shared folders and shared drives from your dashboard. Granting emails them the links and reports it to IT.
Results
Pending Approvals
Confidential-site access requests submitted through Manual Grant or Replicate. Approving here grants the request immediately, using your own SharePoint permissions — the request itself never grants anything on its own.
Activity Log
Every grant, change, removal, and confidential-access decision made through Permission Center or My Team's Access — who did it, to whom, and what happened. Most recent first.