pH7x SystemspH7x Systems®
ExpertiseKnowledgeToolsField GuideBlogAbout
← pH7x KnowledgeSharePoint

How to find SharePoint lists with unique permissions

Which lists have broken role inheritance?

By João Livio·pH7x Knowledge

30-second answer

powershell
Get-PnPList -Includes HasUniqueRoleAssignments |
  Where-Object { $_.HasUniqueRoleAssignments }

Every list returned no longer inherits permissions from its site.

What this proves

The list itself has broken role inheritance: somebody, or some process, gave it permissions of its own. From that moment the site's permissions stop telling you who can reach this list.

What it does not prove

  • How many items inside the list have unique permissions. Item-level inheritance is a separate question and a far more expensive one: it means walking every item.
  • Whether the break was deliberate. Sharing a single document breaks inheritance on that item; a migration tool can break it on the whole list. The flag records the state, not the intent.
  • Who can access the list now. That requires reading its role assignments, which this call does not load.

PowerShell

powershell
Get-PnPList -Includes HasUniqueRoleAssignments, ItemCount, Hidden |
  Where-Object { $_.HasUniqueRoleAssignments -and -not $_.Hidden } |
  Select-Object Title, ItemCount

HasUniqueRoleAssignments is not loaded by default. Without -Includes, reading the property triggers a lazy load per list; with it, one request brings it for all of them.

Example output

text
Title            ItemCount
-----            ---------
Contracts             4812
Board packs            96

Explanation

A list with unique permissions is where permission reviews go to fail: whoever audits the site sees the site's permissions and not the list's. The number of these lists is also a scale question. Each broken inheritance adds permission scopes, and SharePoint enforces a hard limit of 50,000 unique scopes per list, with a documented recommendation to stay below 5,000.

Production considerations

  • Include hidden lists when the question is governance rather than content: system lists can carry unique permissions too. Drop the Hidden filter for that.
  • Past 100,000 items, SharePoint refuses to break inheritance on the list at all. The state you observe today may not be changeable tomorrow.
  • Counting unique scopes item by item is the expensive path. Do it only when a specific list is under investigation, not as a tenant sweep.

References