How to find SharePoint lists with unique permissions

30-second answer

Get-PnPList -Includes HasUniqueRoleAssignments |
  Where-Object { $_.HasUniqueRoleAssignments }

Every list returned no longer inherits permissions from its site.

What this proves

The list itself has broken role inheritance: somebody, or some process, gave it permissions of its own. From that moment the site's permissions stop telling you who can reach this list.

What it does not prove

• How many items inside the list have unique permissions. Item-level inheritance is a separate question and a far more expensive one: it means walking every item.
• Whether the break was deliberate. Sharing a single document breaks inheritance on that item; a migration tool can break it on the whole list. The flag records the state, not the intent.
• Who can access the list now. That requires reading its role assignments, which this call does not load.

PowerShell

Get-PnPList -Includes HasUniqueRoleAssignments, ItemCount, Hidden |
  Where-Object { $_.HasUniqueRoleAssignments -and -not $_.Hidden } |
  Select-Object Title, ItemCount

HasUniqueRoleAssignments is not loaded by default. Without -Includes, reading the property triggers a lazy load per list; with it, one request brings it for all of them.

Example output

Title            ItemCount
-----            ---------
Contracts             4812
Board packs            96

Explanation

A list with unique permissions is where permission reviews go to fail: whoever audits the site sees the site's permissions and not the list's. The number of these lists is also a scale question. Each broken inheritance adds permission scopes, and SharePoint enforces a hard limit of 50,000 unique scopes per list, with a documented recommendation to stay below 5,000.

Production considerations

• Include hidden lists when the question is governance rather than content: system lists can carry unique permissions too. Drop the Hidden filter for that.
• Past 100,000 items, SharePoint refuses to break inheritance on the list at all. The state you observe today may not be changeable tomorrow.
• Counting unique scopes item by item is the expensive path. Do it only when a specific list is under investigation, not as a tenant sweep.

Related governance rules

• SPO-LIST-001: past 100,000 items inheritance can no longer be broken
• SPO-LIST-002: the 50,000 unique scope hard limit
• SPO-LIST-003: the 5,000 recommended limit

References

• SharePoint limits (Microsoft Learn)
• Manage permission scopes (Microsoft Learn)
• Get-PnPList (PnP PowerShell)

Found something wrong? Suggest a correction. The article source is not public; the engine it cites is.