Enable monitoring for a scope
- Open Permission backups and choose the workspace and Site or library.
- Under Save permission backups, find Permission change monitoring below Scheduled backups.
- Select Enable permission change monitoring for this scope and choose the change categories you want to watch.
- Optionally select Email a summary to your account address. The address comes from your signed-in account; it is not an arbitrary recipient field.
- Choose Save monitoring. Starting or resuming uses the latest complete backup as a baseline. If none exists, the first complete backup establishes it without alerting on all existing access.
- Use a daily or weekly backup schedule for ongoing captures. Manual backups also trigger checks, normally within a minute of completion.
Understand the alert rules
Inherited children do not repeat the same parent assignment change. Parent-context changes are included when that parent supplies inherited access to the selected scope. Group memberships are not expanded, and external recipients that cannot be identified from the saved records are outside these checks.
| Rule | What is detected |
|---|---|
| New external access | New recorded assignments for known direct guests and new active Anyone links. Email domain differences alone do not prove guest identity. |
| Permission increases | Additional rights on an existing assignment, based on the combined permission masks rather than role names. Includes Read to Edit and a sharing link changed to Edit. |
| Inheritance changes | An existing object switching between unique and inherited permissions. |
Complete baselines and coverage gaps
Each successful comparison advances the baseline, including comparisons with no selected changes. A partial or failed capture reports a coverage warning and retains the last complete baseline. It does not imply permissions were removed or that there were no changes.
Monitoring compares observations captured over scan intervals. It cannot identify who made a change or detect a change that appeared and disappeared between backups. It does not calculate a person’s effective access, monitor group membership, or replace Microsoft audit logs.
Review an alert
- Find Permission change alerts in the monitoring panel. New and Reviewed labels show whether you have acknowledged an alert.
- Choose View alert to read each recorded change, object, recipient, and before/after access.
- Choose Load more alert details when offered. Summary counts include every detected event; up to 500 detailed events are retained per comparison, with a visible notice if details are capped.
- Use Compare these backups to open the original baseline/current comparison. Preparing recovery remains a separate choice; select and review eligible changes before approval.
- Choose Mark reviewed when you have assessed the alert. This acknowledges the alert without changing Microsoft 365 permissions.
Control email summaries
Email summaries contain category counts and a private link to the alert. Object paths, recipients, and sharing-link URLs stay in the app. Open the link using the ShareRestore account that owns the workspace.
Turn off the email checkbox and save to stop future summaries, or turn off monitoring and save to stop comparisons. Queued email eligibility is checked again before delivery. Enabling email does not send the older alert history. In-app alerts remain available when email delivery is unavailable.
Email uses the existing delivery queue, retry controls, and suppression handling. A summary can arrive after its in-app alert; review the app when a notification is delayed.
Monitoring and recovery costs
Monitoring, alerts, manual and scheduled permission backups, comparisons, plan preparation, and CSV exports are free. Monitoring does not apply permission changes or consume restore credits.
If you choose to recover access, review its separate credit estimate, acknowledge credit use, and approve the recovery. It uses the same restore credits and verification rules as core restoration.