Find the correct person
- Choose Who has access? in the application menu, or use Look up a person's access from a saved backup scope.
- Select the workspace and site or library. The backup menu selects the latest complete backup by default; you can choose another finished backup, including a partial backup with coverage gaps.
- Enter at least two characters of a name, email, or login and choose Find people. Directory searches match the beginning of these fields; saved backup people also match text within the field. Narrow the search if more than 20 people match.
- Select the exact account by its login. Names and email aliases alone do not prove identity. Current directory search also finds people who are only members of groups.
- Optionally choose Check current group membership and a Path contains filter, then select Explain access.
Understand each access path
| Path | What it means |
|---|---|
| Direct assignment | The exact person's login has an active saved role assignment at the object's permission source. Limited Access alone is not counted as content access. |
| SharePoint group | A current membership check connects the person, or one of their directory groups, to a saved SharePoint group assignment. |
| Directory group | Microsoft Graph currently reports the person as a direct or nested member of the directory group recorded in the saved assignment. Intermediate nested group hops are not expanded. |
| Inheritance | The explanation follows saved parent scopes to the nearest unique permission assignment. A unique permission break stops that chain. |
| Sharing link | A link was recorded on the object or an ancestor. The report does not prove recipient eligibility, link possession, current validity, or that an ancestor's link applies to the child. |
| Unresolved | A parent, membership, permission level, or coverage detail could not be verified. This is not an access denial. |
Saved permissions and current membership have different times
Permission assignments describe the backup's scan interval, not an atomic or live permission check. Group membership was not stored in these backups. When requested, ShareRestore reads current membership and shows a separate checked timestamp.
A person may have joined or left a group after the backup. Directory queries can lag recent changes. Use a recent complete backup and review group changes separately when the historical timing matters. Paging results refreshes requested membership checks while retaining the selected saved backup.
Review coverage and unresolved results
- Partial backups and unreadable or unseen objects do not establish access or its absence.
- Saved parent scopes outside the backup, unsupported group claims, changed group/site identities, denied membership reads, and budget limits are shown as unresolved.
- A request checks up to 30 SharePoint groups, 2,000 members per SharePoint group, and 5,000 transitive directory memberships within a bounded time budget. Skipped or incomplete checks remain unresolved.
- Site administrators, hidden group memberships, tenant restrictions, conditional access, guest sign-in policy, and link possession may add or restrict access.
- Specific-people link recipients are not stored in existing permission backups. A link is a potential path even when its type is Read or Edit.
- No matching record never proves that a person has no access. Use SharePoint's own permission checks when a live effective-access decision is needed.
If the tenant connection is unavailable
People named directly in the selected backup can still be searched and explained. Directory-only people need a working matching tenant connection. Current group checks remain unresolved when disconnected or when the connected tenant no longer matches the saved scope.
Open Permission backups to check or reconnect the tenant, then return and search again. Access explanations never create users, add group members, or grant permissions.
Access explanations and restore credits
Access lookups and group membership reads are free and read only. They do not prepare, approve, or execute recovery and do not use restore credits. Separately reviewed and approved recovery uses the existing core restore credit rules.