Choose and review candidates
- Choose Permission cleanup in the app menu, then select the workspace and saved site or library.
- Select a recent complete permission backup. Use Take a fresh backup when needed; wait for it to finish, refresh the list, and select the new capture.
- Choose a finding category or optional path filter, then choose Review cleanup candidates. Reviewing does not change tenant access or spend credits.
- Read the recipient login, saved permission levels, proposed action, and captured impact count. An inherited assignment appears at its unique source rather than on every inheriting child.
- Select individual eligible findings. Selections remain across result pages; changing the backup or filter clears them. Use View all selected findings to check or remove selections before preparing a plan.
Understand eligible changes
| Finding | Available action |
|---|---|
| Direct guest access | Remove the selected direct guest assignment and its active role bindings. Guest identity must be recorded or use a recognized guest claim; email domain differences do not establish guest status. |
| Broad direct access | Remove recognized Everyone or matching-tenant Everyone except external users direct assignments. Display names are not used to guess broad access. |
| Redundant unique permissions | Restore inheritance only for a confirmed file or non-folder list item whose active assignments match its verified parent, with no sharing links or captured descendants. Future parent changes then apply. |
| Broad sharing links | Review only. Open SharePoint to assess the link. This cleanup does not delete links or recreate original link URLs. |
| Administrative, different, or uncertain permissions | Review only. Full Control, custom administrative roles, sites, libraries, folders, different parent access, and incomplete coverage require manual review. |
Review and approve the plan
- Choose Review selected cleanup. Loading feedback appears while the plan and credit estimate are prepared, then the page moves to the review section.
- Inspect every selected object and operation. Up to 200 findings, 100 changed objects, and 400 permission operations can be included.
- Do not combine direct removal with inheritance reset on the same object, or select a parent change and its child's inheritance reset in the same plan. Finish the first change, take a new backup, and review again.
- Review the maximum new restore credits, available balance, and already credited objects. Select the approval checkbox, then choose Approve and apply cleanup.
- Plans expire after 30 minutes. Preparation and review do not apply changes; approval is required.
Backups, drift checks and verification
The existing backup worker saves a fresh Before permission cleanup snapshot before any writes. It checks complete coverage and all selected targets before reserving credits, then rechecks native identities, roles, parent access and permission hashes before operations. Unreadable data, drift or failed checks block the affected change.
Cleanup changes selected role assignments or eligible inheritance only. It does not edit file contents, delete accounts, change group membership, remove site administrators, delete links, or send invitations. Other direct grants, groups, links and administrator access may still provide access after removal.
The captured impact count includes objects inheriting from the selected permission source in that backup. It is not a tenant-wide effective-access calculation. Hidden/system lists, subsites, group membership and sharing-link recipient eligibility remain outside this review.
Track results and recover if needed
Cleanup history shows Draft, Queued, In progress, Completed, Completed with issues, or Failed. Queued and running work displays progress indicators and refreshes automatically. Open a cleanup to inspect each object's verified, failed or skipped result.
The before-change backup remains in Permission backups. To reverse eligible direct permission changes, compare that baseline with a new backup, select the intended differences, review, and approve recovery separately. Inheritance changes require the parent's access to satisfy recovery checks. Recovery is not an automatic rollback and cannot recreate deleted links or past group membership.
Cleanup and restore credits
Candidate reviews, saved backups and cleanup-plan preparation are free. Approved cleanup uses the existing restore-credit policy: one credit per unique object with a verified permission change in the same workspace, regardless of the number of selected recipients or role operations on it.
Inheriting children are part of the impact rather than extra changed-object charges. An object previously credited by core restore, permission recovery or cleanup in that workspace is not charged again. Unverified changes do not consume new credits. The plan's estimate and explicit credit acknowledgement are required before approval.