---
title: Permission Graph
description: One interactive map of every identity, resource, and permission in your tenant - so "why does this user have access to this file?" becomes a path you can see, not a project.
icon: Network
---

# Permission Graph

The permission graph answers the question that burns more analyst hours than any other in Microsoft 365: **"Why does this person have access to this file?"** Native tools can sometimes tell you _that_ someone has access. The _why_ - the chain of nested groups, site inheritance, and sharing links behind it - is scattered across admin centers and PowerShell output. 1Security draws it as a path you can walk, in either direction, from any starting point.

## What You Can Achieve

<Cards>
  <Card
    title="Trace any access to its source"
    description="Start from a file and walk out to every identity that can reach it - or start from a user and walk to everything they can touch. Every hop shows the mechanism: which group, nested how deep, inherited from which site, opened by which link."
  />
  <Card
    title="Audit by traveling, not exporting"
    description="Every entity is a doorway to the next: user → their actions → the files they modified → who else can read those files → whether they hold sensitive data. One continuous investigation instead of five disconnected exports."
  />
  <Card
    title="Resolve the access nobody granted deliberately"
    description="Nested group membership and SharePoint inheritance create reach that no admin ever approved as such. The graph resolves indirect access completely, so effective permissions - not declared ones - are what you audit."
  />
  <Card
    title="Zoom from tenant to a single edge"
    description="See permission creep at the bird's-eye level, then drill until you're looking at one specific grant connecting one identity to one resource - and remove it if it shouldn't exist."
  />
</Cards>

## One Map, Every Relationship

The graph connects the two halves of your tenant that Microsoft keeps in separate tools:

- **Identities** - users, groups, third-party apps, and AI agents.
- **Resources** - sites, files, and emails.

The edges between them are the permissions and activity that actually matter: membership, direct grants, link access, inheritance, and actions taken. Because indirect paths are resolved - including the hard ones, like multi-level group nesting and per-site SharePoint permission inheritance - the graph is a **single source of truth** for who has access to what at any moment.

## Where the Graph Works for You

The graph isn't a page you visit; it's the backbone the platform runs on, and every screen is one of its views:

- The [Files screen](/en/docs/screens/files) answers "who has access to our files - and why?" with the graph's resolved paths behind every count.
- The [Groups screen](/en/docs/screens/groups) shows effective membership - nesting resolved - and the blast radius each group unlocks.
- The [Sites screen](/en/docs/screens/sites) separates direct from indirect access, so you see through which doors people enter each site.
- The [Apps](/en/docs/screens/apps) and [Agents](/en/docs/screens/agents) screens quantify how far third-party software and AI reach along the same edges.
- The [Activity Logs](/en/docs/screens/activity-logs) attribute every action to the actor, resource, app, device, and location - the graph in motion.
- [Trends](/en/docs/screens/trends) evaluate conditions over the graph continuously, turning any pattern you can describe into an alert.

## Investigative Patterns

<Callout type="info">
  **The why-chain audit**: pick a high-risk detection on the [Sensitive Info
  screen](/en/docs/screens/sensitive-info), open the files that carry it, and
  walk each access path to its origin. Every path ends in one of three places -
  a deliberate grant, a forgotten link, or an inheritance nobody considered. The
  second and third are your findings, and you can revoke them where you stand.
</Callout>