Protect exports permissions as a matrix workbook. Protect Pro can read that structure back to add validated SharePoint-group assignments. Import doesn't synchronize or remove access.
Understand the workbook
The exported workbook contains a worksheet named permissions:
| Area | Meaning |
|---|---|
| First column | SharePoint content path |
| Columns B and later | One principal per column |
| Principal header | Principal name and type |
| Assignment cell | One SharePoint access-level name or multiple comma-separated names |
| Yellow path cell | Item has custom access |
| White path cell | Item inherits access |
Assignment cells include an Excel dropdown based on role names in a hidden validation worksheet. Use those listed values to avoid spelling drift.
Export permission data
- Open the site or location in Protect.
- Enable Load nested sharing entries if child content belongs in the review.
- Wait for loading to finish.
- Apply the filters needed for on-screen analysis.
- Select Export to Excel.
- Open the workbook and confirm the expected paths, principals, and roles.
- Save an unchanged source copy in the approved evidence location.
Filters help reviewers analyze the screen, but always verify workbook scope before treating the file as evidence.
Prepare an import workbook
Start from a current Protect export from the target site.
- Keep the first path column and principal headers unchanged.
- Keep only group principal columns that the target site can resolve by exact SharePoint group title.
- In each applicable path row, enter one role name or comma-separated role names from the cell dropdown.
- Leave a cell blank when no new group assignment should be added for that path.
- Don't add individual email addresses, guests, sharing-link principals, or system groups.
- Save the workbook as a supported Excel file.
Import ignores sharing-link principals, the Limited Access System Group, principals containing an email-address marker, and paths that don't have the expected site-relative structure.
Validate an import
- In Protect, open the target site.
- Select Import from Excel.
- Choose the prepared workbook.
- Wait while Protect checks unique paths across the site.
- Review every preview row across Path, Member, Role, Type, and Status.
- Correct the workbook if a row shows Path not found, Member not found, Role not found, or a missing value.
- Repeat import until every row shows Ready.
Protect validates paths with the signed-in user's site access, group titles against loaded SharePoint groups, and role names against the site's existing access levels.
Grant imported access
- Confirm that the preview contains only intended additive assignments.
- Select Grant access.
- Wait for the save to complete.
- Select Refresh in the permission explorer.
- Filter to the imported groups and paths.
- Verify the new entries in Protect and SharePoint.
The Grant access button remains disabled while path checks run or any row is invalid.
Maintain review evidence
- Retain the unchanged export and the approved import separately.
- Record the reviewer, approver, business purpose, date, and change reference.
- Split unrelated changes into separate workbooks.
- Pilot a large change with representative paths first.
- Re-export after the change when your audit process requires proof of resulting state.