What is captured and recoverable
| Access or object | Behavior |
|---|---|
| Native user and group role assignments | Saved with their permission levels. Selected supported changes can be recovered to the same existing principals. |
| Permission inheritance | Saved for comparison. Selected repairs require the inheritance opt-in and current parent-access checks. |
| A site scope | Includes the site and its visible lists, libraries, and items within capture limits. |
| A list or library scope | Includes its visible items. The site is captured as parent context; recover site access through a separate site scope. |
| Document sharing links | Recorded for comparison. Permission recovery does not recreate or remove their URLs. |
What this feature does not recover
- Document contents, document versions, deleted files, or replacement objects.
- Group membership, site administrator membership, new user accounts, guest invitations, or cross-tenant identity mappings.
- Hidden/system lists or subsites inside a parent-site scope. Add a subsite as a separate scope when needed.
- Sharing-link URLs or tokens, and system sharing principals.
- A single atomic view of SharePoint at one instant: a backup is captured over a scan interval.
Handle partial and incomplete backups
A capture is bounded by a 10,000-object budget and a scan time limit. Larger or unreadable scopes are marked incomplete. View coverage identifies captured objects and coverage notes; inspect these rather than relying only on the total object count.
Choose a smaller list or library when a site exceeds the limit. Do not interpret an unavailable object or unreadable permission record as empty access. Recovery refuses incomplete objects and other unsupported changes.
A failed capture does not replace a valid previous baseline. Correct the connection or scope issue, take a fresh backup, and inspect coverage before comparing again.
Why a selected change may be blocked
- The object or principal is missing or has been replaced, or its permission definition changed.
- Live access changed after the comparison, so the prepared operations no longer match the reviewed state.
- The parent access needed for an inheritance repair no longer agrees with the saved and compared access. The parent is checked again before writing.
- The selected removal would remove the last Full Control assignment. This safeguard does not calculate effective group membership.
- The selected difference is outside the chosen recovery mode, or inheritance repair was not enabled.
Keep the results in context
A backup is an access record, not an effective-access report. A user with No direct grant can still have access through a group or inherited permissions.
Review the before-recovery backup, per-object verification, and live SharePoint access after recovery. Take a new backup and comparison to confirm the final state. A completed schedule or recovery does not mean every possible permission or content type was covered.