SharePoint permissions reports and audit logs explained

Key insights

• The video distinguishes permission reports, which show access, from audit logs, which record activity.
• Its examples cover site access, external permissions, anonymous links, and access through Everyone.
• The native external-sharing report shown in the video stops at the top 100 sites.
• The description says most native reports reach back 28 days and permission snapshots refresh monthly.
• ShareGate Protect's AI report builder is used to answer an audit question with one list.

Dougie Wood [MVP] recently published a 22-minute video comparing native SharePoint reporting with ShareGate Protect for permission and audit questions. The central point is that a permissions report and an audit log answer different questions: one helps show who can access content, while the other records activity. That distinction matters when someone asks for evidence of access across a tenant or over a longer period.

What's new

The video is a practical walkthrough of common SharePoint security audit questions rather than an announcement of a new Microsoft feature. Wood says he answers real questions first using native options, then repeats them in ShareGate, so viewers can see where the built-in route runs out. The scenarios named in the description include site access, external user permissions, anonymous sharing links, and access granted through “Everyone.”

Another question is how to find abandoned or outdated sites. The video description says the walkthrough uses ShareGate's data access governance features and ends by looking at how to evidence that cleanup has stuck. It also mentions Insight Trends and a saved report that can be run again next quarter.

A key comparison is the native SharePoint external-sharing report. In the video, it reaches only the top 100 sites; Wood then runs the same question without that cap using ShareGate. The description also says most native reports reach back 28 days, while permission snapshots refresh monthly. Those limits can matter when an auditor asks about a year of evidence or when sharing settings have changed since a snapshot was created.

Why it matters

For SharePoint administrators, the practical issue is matching the report to the question. A permission report is about who can see content; an audit log is about actions and activity. Treating one as a substitute for the other can result in the wrong evidence being submitted, a distinction Wood explicitly highlights in the video description.

For governance and security teams, the examples offer a way to frame access reviews around exposure: check external users, anonymous links, broad access through “Everyone,” and sites that may no longer be needed. These are the particular audit questions covered in the video, not a claim that one report fully resolves every permission scenario.

For teams supporting Microsoft 365 Copilot, Wood connects access governance to the fact that Copilot can surface content a user already has access to across Microsoft 365 and Teams. The takeaway is about permissions: knowing who can see what in SharePoint is relevant to understanding the content users may encounter. The material does not claim that the reports change Copilot behavior or remove permissions automatically.

The walkthrough also illustrates a trade-off for administrators: native reports can be a starting point, but stated limits on site count, lookback, and snapshot refresh can leave gaps in an evidence request. ShareGate is presented as an alternative route in this demonstration. The video does not establish licensing requirements, pricing, or availability for either reporting path.

How it works

The described workflow starts with the audit question itself. In ShareGate Protect, Wood uses the AI report builder by entering the question in ordinary language; the description says this produces one list rather than requiring three exports to be joined in a spreadsheet. The video compares that result with the native route, allowing viewers to see the difference for the same kind of request.

1. Choose a specific SharePoint access question, such as which external users or anonymous links are involved.
2. Run the native report where one is available, and note its stated scope or limits. The example external-sharing report stops at the top 100 sites.
3. Ask the equivalent question in ShareGate Protect's AI report builder and review the resulting list.
4. Use a saved report and Insight Trends, as described in the video, to revisit the cleanup and check that the work can be repeated.

The video also clarifies where the tenant audit trail belongs: Microsoft Purview. Wood distinguishes that tenant audit trail from the activity log recorded by Protect, including what that product activity log does and does not record. This is an important boundary: a permissions report, an activity log in a governance tool, and the tenant audit trail are not interchangeable evidence sources.

Limitations and open questions

The figures and limits here are those stated in the video description: most native reports reach back 28 days, permission snapshots refresh monthly, and the native external-sharing report demonstrated is capped at the top 100 sites. The description does not identify which specific native reports are included in “most,” or explain whether settings, licensing, or tenant configuration change those limits. Readers should treat them as the conditions shown in this walkthrough, not as a complete specification of every SharePoint report.

The source material does not provide a full transcript of each on-screen step, detailed report fields, or a comparison of prices and licenses. It also does not establish that ShareGate reports replace Purview audit searches. The safe conclusion is narrower: the video shows a comparison of native reporting and ShareGate for selected access questions, while emphasizing that audit history and permissions evidence serve different purposes.

For an administrator preparing evidence, the useful first step is to identify whether the request concerns current access or past activity, then select a report designed for that purpose. The video is most relevant to people who need to investigate SharePoint access, external sharing, or report scope. It does not show a universal fix for every site or permission model.

Sources

• Dougie Wood's SharePoint permissions and audit reporting walkthrough

Frequently asked questions

Are a SharePoint audit log and a permissions report the same thing?

No. The video distinguishes an audit log, which records activity, from a permissions report, which addresses who can access content.

What limits does the video show in native reporting?

The demonstrated native external-sharing report stops at the top 100 sites. The description also says most native reports reach back 28 days and permission snapshots refresh monthly.

What does ShareGate Protect do in the walkthrough?

Wood uses its AI report builder to enter an audit question and produce one list, then compares that route with native reporting. The material does not provide licensing or pricing details.

Where does the tenant audit trail belong?

The video description identifies Microsoft Purview as the home of the tenant audit trail and distinguishes it from Protect's activity log.