Adding multiple users to SharePoint Data Access Governance report via Powershell

John Dewis 20 Reputation points
2026-09-15T05:30:49.5566667+00:00

Hello,

I'm trying to run a Sharepoint Data Access Governance report on multiple users at once via Powershell. Due to the volume of users, I'm trying to avoid using the Admin Center where possible.

The official guide here (https://learn.microsoft.com/en-us/sharepoint/powershell-for-data-access-governance) and most of what I've found online suggests that this is done via the "UserEmailList" flag, however looking at the official documentation here (https://learn.microsoft.com/en-us/powershell/module/microsoft.online.sharepoint.powershell/start-spodataaccessgovernanceinsight?view=sharepoint-ps) no such flag exists - instead, it users "UserPrincipalNames".

Attempting to run this with the UserPrincipalNames with a given list of strings is throwing a "UserPermissionsReportInvalidInputMoreThanThreshold" error. This is happening regardless of if I use 2 or 100 strings.

Has anyone else come across this error, and if so, how did you get around it?

Microsoft 365 and Office | SharePoint | For business | Windows
0 comments
Answer accepted by question author

AI answer

2026-09-15T05:31:06.53+00:00

For the user permission state report, the supported parameter shown in the SharePoint guidance is -UserEmailList, but the values must be user principal names (UPNs), not arbitrary email strings.

Use this pattern:

Start-SPODataAccessGovernanceInsight -ReportEntity PermissionsReport -ReportType Snapshot -Workload SharePoint -Name "UserSharePointReport" -UserEmailList "******@contoso.com","******@contoso.com"

Key points supported by the documentation:

  1. PermissionsReport is the report entity for listing SharePoint sites accessible to given users.
  2. Although the parameter name is UserEmailList, the report requires UPNs.
  3. A single request supports up to 100 users.
  4. For OneDrive, use -Workload OneDriveForBusiness.
  5. Use Connect-SPOService without the -Credential parameter.
  6. PowerShell support for Data Access Governance requires Microsoft.Online.SharePoint.PowerShell version 16.0.25409 or later.

If UserPermissionsReportInvalidInputMoreThanThreshold occurs even with 2 users, the documented limit itself is not the issue. Based on the supported syntax, the practical checks are:

  1. Verify every value passed to -UserEmailList is the user’s UPN.
    • The guidance explicitly says to fetch the UPN by using Get-MgUser.
    • Do not rely on alternate email aliases.
  2. Keep the request at 100 users or fewer.
  3. Confirm the SharePoint Online PowerShell module version is at least 16.0.25409.
  4. Connect with:
Connect-SPOService

not with the -Credential parameter.

A minimal supported example for SharePoint is:

Start-SPODataAccessGovernanceInsight -ReportEntity PermissionsReport -ReportType Snapshot -Workload SharePoint -Name "UserSharePointReport" -UserEmailList "******@contoso.com","******@contoso.com"

If the input values are true UPNs and the request is still failing below 100 users, the context does not provide another documented workaround or alternate parameter behavior.

References:

AI-generated content may be incorrect. Read our transparency notes for more information.

Was this answer helpful?

1 person found this answer helpful.

1 additional answer

Sort by: Newest
Most helpful Newest Oldest
  1. John Dewis 20 Reputation points
    2026-09-15T05:45:40.9766667+00:00

    Updated module to 16.0.27612.12000, UserEmailList still isn't recognised as a flag but UserPrincipalNames is happy to take multiple users now.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.