v1.5.0 Release

Author: sregan1

CHANGELOG.md

@@ -4,7 +4,7 @@ All notable changes to this project are documented here.
 
 ---
 
-## [Unreleased]
+## [1.5.0] — 2026-07-13
 
 ### Fixed
 
@@ -77,6 +77,10 @@ All notable changes to this project are documented here.
 
 ### Changed
 
+- **Permissions Report — export buttons moved to the top of the results**
+  With large scans producing thousands of rows, the "Export to Excel"/"Export
+  to CSV" buttons at the bottom of the table required a long scroll to reach.
+  They now appear directly below the results summary badges instead.
 - User-identifying diagnostic logging in the User Access scan is now gated
   behind `localStorage.setItem('smartPermissionsDebug', '1')` instead of
   always writing to the browser console.

README.md

@@ -27,6 +27,7 @@ Interactively browse a document library tree and inspect live permissions on any
 | **Three folder indicators** | Circle arrow = unique permissions below; triangle arrow = external access below; both together = both |
 | **External user email decoding** | Decoded email shown beneath the display name in the permissions panel |
 | **Tree filters** | Toggle to show only unique-permission items or only items with external user access |
+| **Tenant-wide access warnings** | "Everyone" and "Everyone except external users" claims are highlighted in red as tenant-wide access instead of appearing as an ordinary group row |
 
 ![Permissions Explorer with a folder selected and the permissions panel showing group members](docs/screenshots/05_explorer.png)
 
@@ -50,6 +51,8 @@ Scan a site's lists, libraries, folders, and files and export a color-coded Exce
 | **Excel export** | In-browser `.xlsx` workbook with color-coded permission levels and an Access Via column |
 | **CSV export** | Plain-text alternative for scripted processing |
 | **Progress bar and timer** | Concurrent, throttling-aware scan with elapsed timer and live item count |
+| **Tenant-wide access warnings** | "Everyone" and "Everyone except external users" claims are highlighted in red as tenant-wide access instead of appearing as an ordinary group row |
+| **Scan-incomplete flag** | Items that couldn't be fully read after retries (transient network/throttling errors) are flagged instead of silently shown as inheriting their parent's permissions |
 
 ![Permissions Report configuration screen](docs/screenshots/02_report_config.png)
 
@@ -70,6 +73,7 @@ Look up any user and see every location they can access on a site, with their ex
 | **Sortable results table** | Click any column header to sort |
 | **Export to Excel / CSV** | Download the results for any user |
 | **Scan history** | Past scans persist in IndexedDB — re-export without re-scanning |
+| **Honest M365 group ownership checks** | If a Graph permission error prevents confirming M365 Group ownership, the result is shown as "Graph permission required" rather than a false Member/Owner result |
 
 ![User Access results showing accessible locations for a selected user](docs/screenshots/07_user_access_complete.png)
 
@@ -260,6 +264,8 @@ sharepoint/solution/
 
 **"The scan takes a very long time"** — User Access and Permissions Report scan time scales with the number of unique permission assignments on the site. Use the scan depth and folder depth settings in the Permissions Report to limit scope, or run the scan against a specific library.
 
+**"I need more detail on a User Access result"** — Run `localStorage.setItem('smartPermissionsDebug', '1')` in the browser console, then re-run the scan and check the console for step-by-step diagnostic logging. Remove the key (or set it to any other value) to turn logging back off.
+
 ---
 
 ## Limitations

USER-GUIDE.md

@@ -1,6 +1,6 @@
 # SharePoint Smart Permissions — User Guide
 
-**Version 1.4.0**
+**Version 1.5.0**
 **Applies to:** SharePoint Online
 
 ---
@@ -150,6 +150,8 @@ The results table appears below the filter bar after every scan:
 - A **Hidden from search** badge marks libraries an admin has excluded from search indexing (NoCrawl) — worth a closer look during an audit, since that setting is sometimes used to keep sensitive content out of sight.
 - The filter box and the **Unique permissions only** / **External users only** checkboxes filter the table and the exports together.
 - Large results paginate at 200 rows — click **Load more** for the rest.
+- **"Everyone" and "Everyone except external users"** claims are highlighted in red as tenant-wide access, both in the table and in the Excel export, so a broad grant doesn't blend in as an ordinary group row.
+- If a temporary network or throttling error prevents an item from being fully read even after retries, it's flagged with a warning banner instead of being silently shown with its parent's permissions. Re-run the scan to retry those items.
 
 ### Understanding the Excel Export
 
@@ -215,6 +217,8 @@ When you select an item, the right panel shows:
 
 Color-coded permission badges: **red** for Full Control, **amber** for Edit/Contribute, **green** for Read/View.
 
+**"Everyone" and "Everyone except external users"** claims are highlighted in red as tenant-wide access rather than appearing as an ordinary group row, since a grant to either of these claims effectively opens the item to the whole organization (or the whole internet, for external sharing links).
+
 ### Expand Group Members
 
 Check **Expand group members** in the options bar to expand each SharePoint group, Security group, or M365 group and show the individual users inside it. This is useful when you need to see exactly which people are covered by a group assignment. Note: expanding Security groups and M365 groups requires the optional `GroupMember.Read.All` Graph permission to be approved in your tenant — SharePoint groups expand without it.
@@ -338,6 +342,8 @@ Permission level badges use the same color coding as the Permissions Explorer (r
 
 When a user has site-level access, an information banner appears explaining that only locations with **unique permission assignments** are listed — all other content is accessible through the site-level permission shown at the top of the list.
 
+On a Microsoft 365 Group-connected site, if a Graph permission error prevents the tool from confirming whether the user is an Owner or Member of the group, the result shows **"Graph permission required"** rather than guessing. Approving the optional `GroupMember.Read.All` Graph permission (see [Expand Group Members](#expand-group-members)) resolves this.
+
 ### Scan History
 
 Every completed scan is saved automatically to a local history log stored in your browser. Click the **History** button in the header to open the history panel, which shows a table of past scans with the date, user, site, and accessible location count. From the history panel you can:
@@ -567,6 +573,11 @@ A: Yes. The tool communicates only with your own SharePoint environment via the
 - Ensure **Include system and hidden libraries** is unchecked in Settings.
 - These libraries are excluded by URL pattern as well as their metadata flags. If they still appear, check that you are running the latest version of the web part package.
 
+### A User Access result looks wrong and you need more detail
+
+- Open the browser console and run `localStorage.setItem('smartPermissionsDebug', '1')`, then re-run the scan. Step-by-step diagnostic messages for that user's access resolution will appear in the console.
+- Set the key to any other value (or remove it) to turn this logging back off.
+
 ---
 
 ## Administrator: Tenant-Wide Provisioning

config/package-solution.json

@@ -3,7 +3,7 @@
   "solution": {
     "name": "Smart Permissions",
     "id": "a2f2de50-4e8b-4f3c-9abc-ef0123456789",
-    "version": "1.4.0.0",
+    "version": "1.5.0.0",
     "includeClientSideAssets": true,
     "skipFeatureDeployment": true,
     "isDomainIsolated": false,

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sharepoint-smart-permissions-webpart",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "private": true,
   "engines": {
     "node": ">=18.17.1 <19.0.0"

src/webparts/smartPermissions/components/PermissionsReportView.tsx

@@ -1036,6 +1036,32 @@ export const PermissionsReportView: React.FC<PermissionsReportViewProps> = ({
               </Badge>
             </div>
 
+            {/* Export buttons live here (top of the results) as well as at the
+                bottom of the table — with potentially thousands of rows, requiring
+                a full scroll just to export defeats the point of a quick export. */}
+            <div className={styles.row}>
+              <Button
+                appearance="primary"
+                icon={<DocumentArrowDown24Regular />}
+                onClick={handleExport}
+                disabled={isExporting || exportableEntries.length === 0}
+              >
+                {isExporting
+                  ? 'Generating Excel…'
+                  : exportableEntries.length < entries.length
+                  ? `Export ${exportableEntries.length} filtered rows`
+                  : 'Export to Excel'}
+              </Button>
+              <Button
+                appearance="secondary"
+                icon={<DocumentArrowDown24Regular />}
+                onClick={handleExportCsv}
+                disabled={isExporting || exportableEntries.length === 0}
+              >
+                Export to CSV
+              </Button>
+            </div>
+
             {roleAssignmentsDenied && (
               <MessageBar intent="warning">
                 <MessageBarBody>
@@ -1208,29 +1234,6 @@ export const PermissionsReportView: React.FC<PermissionsReportViewProps> = ({
                 )}
               </>
             )}
-
-            <div className={styles.row}>
-              <Button
-                appearance="primary"
-                icon={<DocumentArrowDown24Regular />}
-                onClick={handleExport}
-                disabled={isExporting || exportableEntries.length === 0}
-              >
-                {isExporting
-                  ? 'Generating Excel…'
-                  : exportableEntries.length < entries.length
-                  ? `Export ${exportableEntries.length} filtered rows`
-                  : 'Export to Excel'}
-              </Button>
-              <Button
-                appearance="secondary"
-                icon={<DocumentArrowDown24Regular />}
-                onClick={handleExportCsv}
-                disabled={isExporting || exportableEntries.length === 0}
-              >
-                Export to CSV
-              </Button>
-            </div>
           </div>
         )}
       </div>}