Merge branch 'main' of https://git.azuze.fr/kawa/Sharepoint-Toolbox

SharepointToolbox.Tests/Services/Export/CsvExportServiceTests.cs

@@ -48,6 +48,54 @@ public class CsvExportServiceTests
         Assert.Contains("Object", csv);
     }
 
+    [Fact]
+    public void BuildCsv_WithResolvedTarget_IncludesTargetColumns()
+    {
+        var entry = new PermissionEntry(
+            ObjectType: "Site",
+            Title: "HR",
+            Url: "https://contoso.sharepoint.com/sites/HR",
+            HasUniquePermissions: true,
+            Users: "Limited Access System Group For List b20e3b22-2b09-4c99-9ba4-37b42f3a12dc",
+            UserLogins: "Limited Access System Group For List b20e3b22-2b09-4c99-9ba4-37b42f3a12dc",
+            PermissionLevels: "Limited Access: Edit",
+            GrantedThrough: "SharePoint Group: Limited Access System Group For List b20e3b22-2b09-4c99-9ba4-37b42f3a12dc",
+            PrincipalType: "SharePointGroup",
+            TargetUrl: "https://contoso.sharepoint.com/sites/HR/Lists/Payroll",
+            TargetLabel: "Payroll");
+
+        var svc = new CsvExportService();
+        var csv = svc.BuildCsv(new[] { entry });
+
+        Assert.Contains("TargetLabel", csv);
+        Assert.Contains("TargetUrl", csv);
+        Assert.Contains("Payroll", csv);
+        Assert.Contains("https://contoso.sharepoint.com/sites/HR/Lists/Payroll", csv);
+    }
+
+    [Fact]
+    public void BuildCsv_WithSharingLink_IncludesLinkType()
+    {
+        var entry = new PermissionEntry(
+            ObjectType: "Folder", Title: "Reports", Url: "https://contoso.sharepoint.com/sites/HR/Docs",
+            HasUniquePermissions: true,
+            Users: "SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.OrganizationEdit.64c27910-66ea-421d-b0f0-8f0f72dcfaf6",
+            UserLogins: "SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.OrganizationEdit.64c27910-66ea-421d-b0f0-8f0f72dcfaf6",
+            PermissionLevels: "Contribute",
+            GrantedThrough: "SharePoint Group: SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.OrganizationEdit.64c27910-66ea-421d-b0f0-8f0f72dcfaf6",
+            PrincipalType: "SharePointGroup",
+            TargetUrl: "https://contoso.sharepoint.com/sites/HR/Docs/Q4.xlsx",
+            TargetLabel: "Q4.xlsx",
+            SharingLinkType: "OrganizationEdit");
+
+        var svc = new CsvExportService();
+        var csv = svc.BuildCsv(new[] { entry });
+
+        Assert.Contains("SharingLinkType", csv);
+        Assert.Contains("OrganizationEdit", csv);
+        Assert.Contains("Q4.xlsx", csv);
+    }
+
     [Fact]
     public void BuildCsv_WithDuplicateUserPermissionGrantedThrough_MergesLocations()
     {

SharepointToolbox.Tests/Services/Export/HtmlExportServiceTests.cs

@@ -156,6 +156,146 @@ public class HtmlExportServiceTests
         Assert.Contains("getAttribute('data-group-target')", html);
     }
 
+    // ── System-group target rendering (Limited Access / SharingLinks) ────────
+
+    [Fact]
+    public void BuildHtml_WithResolvedListTarget_RendersClickableLink()
+    {
+        var entry = new PermissionEntry(
+            ObjectType: "Site",
+            Title: "Contoso HR",
+            Url: "https://contoso.sharepoint.com/sites/HR",
+            HasUniquePermissions: true,
+            Users: "Limited Access System Group For List b20e3b22-2b09-4c99-9ba4-37b42f3a12dc",
+            UserLogins: "Limited Access System Group For List b20e3b22-2b09-4c99-9ba4-37b42f3a12dc",
+            PermissionLevels: "Limited Access: Edit",
+            GrantedThrough: "SharePoint Group: Limited Access System Group For List b20e3b22-2b09-4c99-9ba4-37b42f3a12dc",
+            PrincipalType: "SharePointGroup",
+            TargetUrl: "https://contoso.sharepoint.com/sites/HR/Lists/Payroll",
+            TargetLabel: "Payroll");
+
+        var svc = new HtmlExportService();
+        var html = svc.BuildHtml(new[] { entry });
+
+        Assert.Contains("https://contoso.sharepoint.com/sites/HR/Lists/Payroll", html);
+        Assert.Contains(">Payroll</a>", html);
+    }
+
+    [Fact]
+    public void BuildHtml_WithSharingLinkTarget_RendersLinkTypeBadgeAndTarget()
+    {
+        var entry = new PermissionEntry(
+            ObjectType: "Folder",
+            Title: "Reports",
+            Url: "https://contoso.sharepoint.com/sites/HR/Shared%20Documents/Reports",
+            HasUniquePermissions: true,
+            Users: "SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.OrganizationEdit.64c27910-66ea-421d-b0f0-8f0f72dcfaf6",
+            UserLogins: "SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.OrganizationEdit.64c27910-66ea-421d-b0f0-8f0f72dcfaf6",
+            PermissionLevels: "Contribute",
+            GrantedThrough: "SharePoint Group: SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.OrganizationEdit.64c27910-66ea-421d-b0f0-8f0f72dcfaf6",
+            PrincipalType: "SharePointGroup",
+            TargetUrl: "https://contoso.sharepoint.com/sites/HR/Shared%20Documents/Reports/Q4.xlsx",
+            TargetLabel: "Q4.xlsx",
+            SharingLinkType: "OrganizationEdit");
+
+        var svc = new HtmlExportService();
+        var html = svc.BuildHtml(new[] { entry });
+
+        // Friendly label, raw code preserved as tooltip
+        Assert.Contains("Org link", html);
+        Assert.Contains("Edit", html);
+        Assert.Contains("title=\"OrganizationEdit\"", html);
+        Assert.Contains("Q4.xlsx", html);
+        Assert.Contains("https://contoso.sharepoint.com/sites/HR/Shared%20Documents/Reports/Q4.xlsx", html);
+    }
+
+    [Theory]
+    [InlineData("OrganizationView", "Org link", "View")]
+    [InlineData("AnonymousEdit",    "Anyone",   "Edit")]
+    [InlineData("Direct",           "Specific people", null)]
+    [InlineData("Flexible",         "Custom link",     null)]
+    public void BuildHtml_FriendlyLinkLabel_ReplacesRawType(string raw, string expectedPart, string? expectedSecond)
+    {
+        var entry = new PermissionEntry(
+            ObjectType: "File", Title: "Doc.docx",
+            Url: "https://contoso.sharepoint.com/sites/HR/Docs/Doc.docx",
+            HasUniquePermissions: true,
+            Users: $"SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.{raw}.64c27910-66ea-421d-b0f0-8f0f72dcfaf6",
+            UserLogins: $"SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.{raw}.64c27910-66ea-421d-b0f0-8f0f72dcfaf6",
+            PermissionLevels: "Contribute",
+            GrantedThrough: $"SharePoint Group: SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.{raw}.64c27910-66ea-421d-b0f0-8f0f72dcfaf6",
+            PrincipalType: "SharePointGroup",
+            TargetUrl: "https://contoso.sharepoint.com/sites/HR/Docs/Doc.docx",
+            TargetLabel: "Doc.docx",
+            SharingLinkType: raw);
+
+        var svc = new HtmlExportService();
+        var html = svc.BuildHtml(new[] { entry }, null, null, hideSystemGroupRaw: true);
+
+        Assert.Contains(expectedPart, html);
+        if (expectedSecond is not null)
+            Assert.Contains(expectedSecond, html);
+        Assert.Contains($"title=\"{raw}\"", html);
+    }
+
+    [Fact]
+    public void BuildHtml_WithSharingLinkAndHideRaw_OmitsRawGroupString()
+    {
+        var entry = new PermissionEntry(
+            ObjectType: "File", Title: "Q4.xlsx",
+            Url: "https://contoso.sharepoint.com/sites/HR/Docs/Q4.xlsx",
+            HasUniquePermissions: true,
+            Users: "SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.OrganizationEdit.64c27910-66ea-421d-b0f0-8f0f72dcfaf6",
+            UserLogins: "SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.OrganizationEdit.64c27910-66ea-421d-b0f0-8f0f72dcfaf6",
+            PermissionLevels: "Contribute",
+            GrantedThrough: "SharePoint Group: SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.OrganizationEdit.64c27910-66ea-421d-b0f0-8f0f72dcfaf6",
+            PrincipalType: "SharePointGroup",
+            TargetUrl: "https://contoso.sharepoint.com/sites/HR/Docs/Q4.xlsx",
+            TargetLabel: "Q4.xlsx",
+            SharingLinkType: "OrganizationEdit");
+
+        var svc = new HtmlExportService();
+        var html = svc.BuildHtml(new[] { entry }, null, null, hideSystemGroupRaw: true);
+
+        // Raw "SharingLinks.{guid}..." text suppressed when target resolved + flag on
+        Assert.DoesNotContain("SharingLinks.e686221e", html);
+        // Target link still rendered
+        Assert.Contains("Q4.xlsx", html);
+        Assert.Contains("OrganizationEdit", html);
+    }
+
+    [Fact]
+    public void BuildHtml_WithSharingLinkButNoTargetAndHideRaw_KeepsRawAsFallback()
+    {
+        // Target resolution failed (deleted item) — flag on, but no TargetUrl → keep raw text.
+        var entry = new PermissionEntry(
+            ObjectType: "File", Title: "Q4.xlsx",
+            Url: "https://contoso.sharepoint.com/sites/HR/Docs/Q4.xlsx",
+            HasUniquePermissions: true,
+            Users: "SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.OrganizationEdit.64c27910-66ea-421d-b0f0-8f0f72dcfaf6",
+            UserLogins: "SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.OrganizationEdit.64c27910-66ea-421d-b0f0-8f0f72dcfaf6",
+            PermissionLevels: "Contribute",
+            GrantedThrough: "SharePoint Group: SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.OrganizationEdit.64c27910-66ea-421d-b0f0-8f0f72dcfaf6",
+            PrincipalType: "SharePointGroup",
+            SharingLinkType: "OrganizationEdit");
+
+        var svc = new HtmlExportService();
+        var html = svc.BuildHtml(new[] { entry }, null, null, hideSystemGroupRaw: true);
+
+        Assert.Contains("SharingLinks.e686221e", html);
+    }
+
+    [Fact]
+    public void BuildHtml_WithoutTarget_RendersGrantedThroughTextOnly()
+    {
+        // Standard SP group with no resolved target — no extra link should appear.
+        var entry = MakeEntry("Owners", "ownersgroup", principalType: "SharePointGroup");
+        var svc = new HtmlExportService();
+        var html = svc.BuildHtml(new[] { entry });
+
+        Assert.DoesNotContain("&rarr;", html);
+    }
+
     [Fact]
     public void BuildHtml_Simplified_WithGroupMembers_RendersExpandablePill()
     {

SharepointToolbox.Tests/Services/Export/UserAccessCsvExportServiceTests.cs

@@ -86,20 +86,15 @@ public class UserAccessCsvExportServiceTests
         var svc = new UserAccessCsvExportService();
         var csv = svc.BuildCsv("Alice", "alice@contoso.com", new[] { DefaultEntry });
 
-        // Find the header row and count its quoted comma-separated fields
-        // Header is: "Site","Object Type","Object","URL","Permission Level","Access Type","Granted Through"
-        // That is 7 fields.
+        // Header: Site, Object Type, Object, URL, Permission Level, Access Type,
+        // Granted Through, TargetLabel, TargetUrl, SharingLinkType → 10 fields.
         var lines = csv.Split('\n', StringSplitOptions.RemoveEmptyEntries);
 
-        // Find a data row (after the blank line separating summary from data)
-        // Data rows contain the entry content (not the header line itself)
-        // We want to count fields in the header row:
         var headerLine = lines.FirstOrDefault(l => l.Contains("\"Site\",\"Object Type\""));
         Assert.NotNull(headerLine);
 
-        // Count comma-separated quoted fields: split by "," boundary
         var fields = CountCsvFields(headerLine!);
-        Assert.Equal(7, fields);
+        Assert.Equal(10, fields);
     }
 
     // ── Test 5: WriteSingleFileAsync includes entries for all users ───────────
@@ -190,8 +185,8 @@ public class UserAccessCsvExportServiceTests
             await svc.WriteSingleFileAsync(entries, tmpFile, CancellationToken.None, mergePermissions: true);
             var content = await File.ReadAllTextAsync(tmpFile);
 
-            // Header must contain consolidated columns
-            Assert.Contains("\"User\",\"User Login\",\"Permission Level\",\"Access Type\",\"Granted Through\",\"Locations\",\"Location Count\"", content);
+            // Header must contain consolidated columns (now includes Target* + SharingLinkType)
+            Assert.Contains("\"User\",\"User Login\",\"Permission Level\",\"Access Type\",\"Granted Through\",\"TargetLabel\",\"TargetUrl\",\"SharingLinkType\",\"Locations\",\"Location Count\"", content);
 
             // Alice's two entries merged — locations column contains both site titles
             Assert.Contains("Contoso", content);

SharepointToolbox.Tests/Services/PermissionEntryClassificationTests.cs

@@ -3,7 +3,8 @@ using SharepointToolbox.Core.Helpers;
 namespace SharepointToolbox.Tests.Services;
 
 /// <summary>
-/// Tests for PERM-03: external user detection and permission-level filtering.
+/// Tests for PERM-03: external user detection, permission-level filtering,
+/// and SharePoint system-group classification (Limited Access / SharingLinks).
 /// Pure static logic — runs immediately without stubs.
 /// </summary>
 public class PermissionEntryClassificationTests
@@ -13,7 +14,6 @@ public class PermissionEntryClassificationTests
     [Fact]
     public void IsExternalUser_WithExtHashInLoginName_ReturnsTrue()
     {
-        // B2B guest login names contain the literal "#EXT#" fragment
         Assert.True(PermissionEntryHelper.IsExternalUser("ext_user_domain.com#EXT#@contoso.onmicrosoft.com"));
     }
 
@@ -28,8 +28,6 @@ public class PermissionEntryClassificationTests
     [Fact]
     public void PermissionEntry_FiltersOutLimitedAccess_WhenOnlyPermissionIsLimitedAccess()
     {
-        // A principal whose sole permission level is "Limited Access" should produce
-        // an empty list after filtering — used to decide whether to include the entry.
         var result = PermissionEntryHelper.FilterPermissionLevels(new[] { "Limited Access" });
         Assert.Empty(result);
     }
@@ -41,23 +39,100 @@ public class PermissionEntryClassificationTests
         Assert.Equal(new[] { "Contribute" }, result);
     }
 
-    // ── IsSharingLinksGroup ────────────────────────────────────────────────────
+    // ── IsBareLimitedAccessSystemGroup ─────────────────────────────────────────
 
     [Fact]
-    public void IsSharingLinksGroup_WithSharingLinksPrefix_ReturnsTrue()
+    public void IsBareLimitedAccessSystemGroup_WithExactMatch_ReturnsTrue()
     {
-        Assert.True(PermissionEntryHelper.IsSharingLinksGroup("SharingLinks.abc123.Edit"));
+        Assert.True(PermissionEntryHelper.IsBareLimitedAccessSystemGroup("Limited Access System Group"));
     }
 
     [Fact]
-    public void IsSharingLinksGroup_WithLimitedAccessSystemGroup_ReturnsTrue()
+    public void IsBareLimitedAccessSystemGroup_WithForWebVariant_ReturnsFalse()
     {
-        Assert.True(PermissionEntryHelper.IsSharingLinksGroup("Limited Access System Group"));
+        // The "For Web {guid}" variant is enriched, not filtered.
+        Assert.False(PermissionEntryHelper.IsBareLimitedAccessSystemGroup(
+            "Limited Access System Group For Web e55a4f7a-b132-4baa-bd96-c63d8dc1fc80"));
     }
 
     [Fact]
-    public void IsSharingLinksGroup_WithNormalGroup_ReturnsFalse()
+    public void IsBareLimitedAccessSystemGroup_WithNormalGroup_ReturnsFalse()
     {
-        Assert.False(PermissionEntryHelper.IsSharingLinksGroup("Owners"));
+        Assert.False(PermissionEntryHelper.IsBareLimitedAccessSystemGroup("Owners"));
+    }
+
+    // ── Classify ───────────────────────────────────────────────────────────────
+
+    [Fact]
+    public void Classify_WithNormalGroupTitle_ReturnsNone()
+    {
+        var c = PermissionEntryHelper.Classify("Site Owners");
+        Assert.Equal(SystemGroupKind.None, c.Kind);
+    }
+
+    [Fact]
+    public void Classify_WithBareLimitedAccess_ReturnsLimitedAccessBare()
+    {
+        var c = PermissionEntryHelper.Classify("Limited Access System Group");
+        Assert.Equal(SystemGroupKind.LimitedAccessBare, c.Kind);
+    }
+
+    [Fact]
+    public void Classify_WithLimitedAccessForWeb_ExtractsWebId()
+    {
+        var c = PermissionEntryHelper.Classify(
+            "Limited Access System Group For Web e55a4f7a-b132-4baa-bd96-c63d8dc1fc80");
+        Assert.Equal(SystemGroupKind.LimitedAccessWeb, c.Kind);
+        Assert.Equal(Guid.Parse("e55a4f7a-b132-4baa-bd96-c63d8dc1fc80"), c.WebId);
+        Assert.Null(c.ListId);
+        Assert.Null(c.ItemUniqueId);
+    }
+
+    [Fact]
+    public void Classify_WithLimitedAccessForList_ExtractsListId()
+    {
+        var c = PermissionEntryHelper.Classify(
+            "Limited Access System Group For List b20e3b22-2b09-4c99-9ba4-37b42f3a12dc");
+        Assert.Equal(SystemGroupKind.LimitedAccessList, c.Kind);
+        Assert.Equal(Guid.Parse("b20e3b22-2b09-4c99-9ba4-37b42f3a12dc"), c.ListId);
+        Assert.Null(c.WebId);
+        Assert.Null(c.ItemUniqueId);
+    }
+
+    [Fact]
+    public void Classify_WithSharingLink_ExtractsItemAndShareId()
+    {
+        var c = PermissionEntryHelper.Classify(
+            "SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.OrganizationEdit.64c27910-66ea-421d-b0f0-8f0f72dcfaf6");
+        Assert.Equal(SystemGroupKind.SharingLink, c.Kind);
+        Assert.Equal(Guid.Parse("e686221e-d1cb-43c5-8c68-04aa7f90f329"), c.ItemUniqueId);
+        Assert.Equal(Guid.Parse("64c27910-66ea-421d-b0f0-8f0f72dcfaf6"), c.ShareId);
+        Assert.Equal("OrganizationEdit", c.LinkType);
+    }
+
+    [Theory]
+    [InlineData("SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.AnonymousView.64c27910-66ea-421d-b0f0-8f0f72dcfaf6", "AnonymousView")]
+    [InlineData("SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.Flexible.64c27910-66ea-421d-b0f0-8f0f72dcfaf6", "Flexible")]
+    [InlineData("SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.OrganizationView.64c27910-66ea-421d-b0f0-8f0f72dcfaf6", "OrganizationView")]
+    public void Classify_WithVariousSharingLinkTypes_PreservesLinkType(string title, string expected)
+    {
+        var c = PermissionEntryHelper.Classify(title);
+        Assert.Equal(SystemGroupKind.SharingLink, c.Kind);
+        Assert.Equal(expected, c.LinkType);
+    }
+
+    [Fact]
+    public void Classify_WithMalformedSharingLink_ReturnsNone()
+    {
+        // Missing share GUID at the end
+        var c = PermissionEntryHelper.Classify("SharingLinks.e686221e-d1cb-43c5-8c68-04aa7f90f329.Edit");
+        Assert.Equal(SystemGroupKind.None, c.Kind);
+    }
+
+    [Fact]
+    public void Classify_WithEmptyString_ReturnsNone()
+    {
+        var c = PermissionEntryHelper.Classify("");
+        Assert.Equal(SystemGroupKind.None, c.Kind);
     }
 }

SharepointToolbox/App.xaml.cs

@@ -149,6 +149,7 @@ public partial class App : Application
         services.AddTransient<VersionCleanupView>();
 
         // Phase 2: Permissions
+        services.AddTransient<ISystemGroupTargetResolver, SystemGroupTargetResolver>();
         services.AddTransient<IPermissionsService, PermissionsService>();
         services.AddTransient<ISiteListService, SiteListService>();
         services.AddTransient<CsvExportService>();

SharepointToolbox/Core/Helpers/PermissionConsolidator.cs

@@ -50,7 +50,10 @@ public static class PermissionConsolidator
                     first.GrantedThrough,
                     first.IsHighPrivilege,
                     first.IsExternalUser,
-                    locations);
+                    locations,
+                    first.TargetUrl,
+                    first.TargetLabel,
+                    first.SharingLinkType);
             })
             .OrderBy(c => c.UserLogin)
             .ThenBy(c => c.PermissionLevel)

SharepointToolbox/Core/Helpers/PermissionEntryHelper.cs

@@ -1,10 +1,56 @@
+using System.Text.RegularExpressions;
+
 namespace SharepointToolbox.Core.Helpers;
 
+/// <summary>
+/// Classifies a SharePoint group name into one of the known system-group shapes.
+/// </summary>
+public enum SystemGroupKind
+{
+    /// <summary>Not a system group — a normal SharePoint group, user, or external user.</summary>
+    None,
+    /// <summary>Bare "Limited Access System Group" pseudo-principal (no embedded target).</summary>
+    LimitedAccessBare,
+    /// <summary>"Limited Access System Group For Web {webId}".</summary>
+    LimitedAccessWeb,
+    /// <summary>"Limited Access System Group For List {listId}".</summary>
+    LimitedAccessList,
+    /// <summary>"SharingLinks.{itemUniqueId}.{linkType}.{shareId}".</summary>
+    SharingLink
+}
+
+/// <summary>
+/// Result of classifying a SharePoint group name.
+/// Carries the embedded GUIDs / link type so a resolver can look up the target.
+/// </summary>
+public readonly record struct SystemGroupClassification(
+    SystemGroupKind Kind,
+    Guid?  WebId,
+    Guid?  ListId,
+    Guid?  ItemUniqueId,
+    string? LinkType,
+    Guid?  ShareId);
+
 /// <summary>
 /// Pure static helpers for classifying SharePoint permission entries.
 /// </summary>
 public static class PermissionEntryHelper
 {
+    // "Limited Access System Group For Web {guid}"
+    private static readonly Regex LimitedAccessWebRegex = new(
+        @"^Limited Access System Group For Web\s+(?<id>[0-9a-fA-F-]{36})\s*$",
+        RegexOptions.Compiled | RegexOptions.IgnoreCase);
+
+    // "Limited Access System Group For List {guid}"
+    private static readonly Regex LimitedAccessListRegex = new(
+        @"^Limited Access System Group For List\s+(?<id>[0-9a-fA-F-]{36})\s*$",
+        RegexOptions.Compiled | RegexOptions.IgnoreCase);
+
+    // "SharingLinks.{itemUniqueId}.{linkType}.{shareId}"
+    private static readonly Regex SharingLinkRegex = new(
+        @"^SharingLinks\.(?<item>[0-9a-fA-F-]{36})\.(?<type>[^.]+)\.(?<share>[0-9a-fA-F-]{36})\s*$",
+        RegexOptions.Compiled | RegexOptions.IgnoreCase);
+
     /// <summary>
     /// Returns true when the login name is a B2B guest (contains #EXT#).
     /// </summary>
@@ -21,10 +67,45 @@ public static class PermissionEntryHelper
             .ToList();
 
     /// <summary>
-    /// Returns true when the login name represents an internal sharing-link group
-    /// or the "Limited Access System Group" pseudo-principal.
+    /// Returns true when the supplied name/login is the bare "Limited Access System Group"
+    /// pseudo-principal — the noise entry with no embedded GUID. The
+    /// per-Web/List and SharingLinks variants are NOT filtered: they are enriched.
     /// </summary>
-    public static bool IsSharingLinksGroup(string loginName) =>
-        loginName.StartsWith("SharingLinks.", StringComparison.OrdinalIgnoreCase)
-        || loginName.Equals("Limited Access System Group", StringComparison.OrdinalIgnoreCase);
+    public static bool IsBareLimitedAccessSystemGroup(string name) =>
+        name.Equals("Limited Access System Group", StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// Classifies a SharePoint group title (the value used in Granted Through). When the
+    /// title matches a known system pattern, the embedded GUIDs / link type are parsed
+    /// out so a resolver can look up the actual targeted Web/List/Item.
+    /// </summary>
+    public static SystemGroupClassification Classify(string groupTitle)
+    {
+        if (string.IsNullOrWhiteSpace(groupTitle))
+            return new SystemGroupClassification(SystemGroupKind.None, null, null, null, null, null);
+
+        var trimmed = groupTitle.Trim();
+
+        if (IsBareLimitedAccessSystemGroup(trimmed))
+            return new SystemGroupClassification(SystemGroupKind.LimitedAccessBare, null, null, null, null, null);
+
+        var mWeb = LimitedAccessWebRegex.Match(trimmed);
+        if (mWeb.Success && Guid.TryParse(mWeb.Groups["id"].Value, out var webId))
+            return new SystemGroupClassification(SystemGroupKind.LimitedAccessWeb, webId, null, null, null, null);
+
+        var mList = LimitedAccessListRegex.Match(trimmed);
+        if (mList.Success && Guid.TryParse(mList.Groups["id"].Value, out var listId))
+            return new SystemGroupClassification(SystemGroupKind.LimitedAccessList, null, listId, null, null, null);
+
+        var mShare = SharingLinkRegex.Match(trimmed);
+        if (mShare.Success
+            && Guid.TryParse(mShare.Groups["item"].Value, out var itemId)
+            && Guid.TryParse(mShare.Groups["share"].Value, out var shareId))
+        {
+            return new SystemGroupClassification(
+                SystemGroupKind.SharingLink, null, null, itemId, mShare.Groups["type"].Value, shareId);
+        }
+
+        return new SystemGroupClassification(SystemGroupKind.None, null, null, null, null, null);
+    }
 }

SharepointToolbox/Core/Helpers/SharingLinkLabels.cs

@@ -0,0 +1,58 @@
+namespace SharepointToolbox.Core.Helpers;
+
+/// <summary>
+/// Risk tier of a SharePoint sharing link, used to color-code the link-type badge
+/// in HTML reports.
+/// </summary>
+public enum SharingLinkRisk
+{
+    Low,     // Read-only, scoped (Org view, Direct, Existing, Review)
+    Medium,  // Org-wide edit
+    High,    // Anonymous (anyone with link, no auth)
+    Unknown  // Unrecognized type — neutral styling
+}
+
+/// <summary>
+/// Maps the raw <c>linkType</c> segment of a <c>SharingLinks.{itemId}.{type}.{shareId}</c>
+/// group name to a human-readable label and a risk tier. The raw codes are SharePoint
+/// internals (OrganizationEdit / AnonymousView / Flexible / …); reports show the friendly
+/// label and tint the badge by tier.
+/// </summary>
+public static class SharingLinkLabels
+{
+    /// <summary>
+    /// Returns the friendly label and risk tier for a sharing-link type code.
+    /// Unknown codes fall through with the raw value and <see cref="SharingLinkRisk.Unknown"/>.
+    /// </summary>
+    public static (string Label, SharingLinkRisk Risk) Describe(string? rawLinkType)
+    {
+        if (string.IsNullOrWhiteSpace(rawLinkType))
+            return (string.Empty, SharingLinkRisk.Unknown);
+
+        return rawLinkType.Trim() switch
+        {
+            "OrganizationView"  => ("Org link · View",       SharingLinkRisk.Low),
+            "OrganizationEdit"  => ("Org link · Edit",       SharingLinkRisk.Medium),
+            "AnonymousView"     => ("Anyone · View",         SharingLinkRisk.High),
+            "AnonymousEdit"     => ("Anyone · Edit",         SharingLinkRisk.High),
+            "Flexible"          => ("Custom link",           SharingLinkRisk.Medium),
+            "Direct"            => ("Specific people",       SharingLinkRisk.Low),
+            "Existing"          => ("Existing access",       SharingLinkRisk.Low),
+            "Review"            => ("Review only",           SharingLinkRisk.Low),
+            "Embed"             => ("Embedded link",         SharingLinkRisk.Medium),
+            _                   => (rawLinkType,             SharingLinkRisk.Unknown)
+        };
+    }
+
+    /// <summary>
+    /// Returns inline-CSS colors (background, foreground) for a risk tier — matches the
+    /// risk-card palette used elsewhere in the HTML reports.
+    /// </summary>
+    public static (string Background, string Foreground) Colors(SharingLinkRisk risk) => risk switch
+    {
+        SharingLinkRisk.Low     => ("#D1FAE5", "#065F46"),
+        SharingLinkRisk.Medium  => ("#FEF3C7", "#92400E"),
+        SharingLinkRisk.High    => ("#FEE2E2", "#991B1B"),
+        _                       => ("#F3F4F6", "#374151"),
+    };
+}

SharepointToolbox/Core/Models/ConsolidatedPermissionEntry.cs

@@ -13,7 +13,10 @@ public record ConsolidatedPermissionEntry(
     string GrantedThrough,
     bool IsHighPrivilege,
     bool IsExternalUser,
-    IReadOnlyList<LocationInfo> Locations
+    IReadOnlyList<LocationInfo> Locations,
+    string? TargetUrl = null,
+    string? TargetLabel = null,
+    string? SharingLinkType = null
 )
 {
     /// <summary>Convenience count — equals Locations.Count.</summary>

SharepointToolbox/Core/Models/PermissionEntry.cs

@@ -14,5 +14,10 @@ public record PermissionEntry(
     string PermissionLevels,    // Semicolon-joined role names (Limited Access already removed)
     string GrantedThrough,      // "Direct Permissions" | "SharePoint Group: <name>"
     string PrincipalType,       // "SharePointGroup" | "User" | "External User"
-    bool   WasAutoElevated = false  // Set to true when site admin was auto-granted to access this entry
+    bool   WasAutoElevated = false, // Set to true when site admin was auto-granted to access this entry
+    // Resolved target for Limited Access System Group For Web/List and SharingLinks
+    // groups — populated when GrantedThrough is one of those system groups, null otherwise.
+    string? TargetUrl = null,
+    string? TargetLabel = null,
+    string? SharingLinkType = null  // OrganizationEdit | OrganizationView | AnonymousEdit | AnonymousView | etc.
 );

SharepointToolbox/Core/Models/SimplifiedPermissionEntry.cs

@@ -41,6 +41,9 @@ public class SimplifiedPermissionEntry
     public string PermissionLevels => Inner.PermissionLevels;
     public string GrantedThrough => Inner.GrantedThrough;
     public string PrincipalType => Inner.PrincipalType;
+    public string? TargetUrl => Inner.TargetUrl;
+    public string? TargetLabel => Inner.TargetLabel;
+    public string? SharingLinkType => Inner.SharingLinkType;
 
     public SimplifiedPermissionEntry(PermissionEntry entry)
     {

SharepointToolbox/Core/Models/SystemGroupTarget.cs

@@ -0,0 +1,15 @@
+using SharepointToolbox.Core.Helpers;
+
+namespace SharepointToolbox.Core.Models;
+
+/// <summary>
+/// Resolved target for a SharePoint system group (Limited Access For Web/List or SharingLinks).
+/// Carries the human-readable label, the navigable URL, and (for sharing links) the link type
+/// so the export layer can render a clickable link in the Granted Through cell.
+/// </summary>
+public record SystemGroupTarget(
+    SystemGroupKind Kind,
+    string Label,            // e.g. "MyList" | "Shared Documents/Folder/File.docx" | "Site - HR"
+    string Url,              // Navigable URL of the targeted resource
+    string? LinkType = null  // For SharingLinks: "OrganizationEdit", "AnonymousView", etc.
+);

SharepointToolbox/Core/Models/UserAccessEntry.cs

@@ -29,5 +29,8 @@ public record UserAccessEntry(
     AccessType AccessType,      // Direct | Group | Inherited
     string GrantedThrough,      // "Direct Permissions" | "SharePoint Group: Members" etc.
     bool IsHighPrivilege,       // True for Full Control, Site Collection Administrator
-    bool IsExternalUser         // True if login contains #EXT#
+    bool IsExternalUser,        // True if login contains #EXT#
+    string? TargetUrl = null,   // Resolved URL when GrantedThrough is a Limited Access / SharingLinks system group
+    string? TargetLabel = null, // Resolved name (list title / file name / web title)
+    string? SharingLinkType = null // OrganizationEdit | OrganizationView | AnonymousEdit | ...
 );

SharepointToolbox/Localization/Strings.fr.resx

@@ -582,6 +582,9 @@ Cette action est irréversible.</value>
   <!-- Phase 16: Report Consolidation Toggle -->
   <data name="audit.grp.export" xml:space="preserve"><value>Options d'exportation</value></data>
   <data name="chk.merge.permissions" xml:space="preserve"><value>Fusionner les permissions en double</value></data>
+  <data name="chk.hide.system.group.raw" xml:space="preserve"><value>Masquer les noms bruts (SharingLinks, Limited Access)</value></data>
+  <data name="chk.exclude.sharing.links" xml:space="preserve"><value>Exclure les liens de partage</value></data>
+  <data name="chk.exclude.system.groups" xml:space="preserve"><value>Exclure les groupes système (Limited Access)</value></data>
   <!-- Phase 19: App Registration & Removal -->
   <data name="profile.register" xml:space="preserve"><value>Enregistrer l'app</value></data>
   <data name="profile.remove" xml:space="preserve"><value>Supprimer l'app</value></data>
@@ -686,6 +689,7 @@ Cette action est irréversible.</value>
   <data name="report.text.generated" xml:space="preserve"><value>G&#233;n&#233;r&#233;</value></data>
   <data name="report.text.generated_colon" xml:space="preserve"><value>G&#233;n&#233;r&#233; :</value></data>
   <data name="report.text.members_unavailable" xml:space="preserve"><value>membres indisponibles</value></data>
+  <data name="report.text.empty_group" xml:space="preserve"><value>Groupe vide</value></data>
   <data name="report.text.link" xml:space="preserve"><value>Lien</value></data>
   <data name="report.text.no_ext" xml:space="preserve"><value>(sans ext.)</value></data>
   <data name="report.text.no_extension" xml:space="preserve"><value>(sans extension)</value></data>
@@ -783,4 +787,84 @@ Cette action est irréversible.</value>
   <data name="report.text.users_parens" xml:space="preserve"><value>utilisateur(s)</value></data>
   <data name="report.text.files_unit" xml:space="preserve"><value>fichiers</value></data>
   <data name="report.text.sites_unit" xml:space="preserve"><value>sites</value></data>
+  <data name="report.text.entries_unit" xml:space="preserve"><value>entr&#233;es</value></data>
+  <!-- Textes d'aide / boutons info -->
+  <data name="help.perm.simplified.title" xml:space="preserve"><value>Mode simplifié</value></data>
+  <data name="help.perm.simplified.body" xml:space="preserve"><value>Regroupe les permissions brutes SharePoint en libellés lisibles (Propriétaire, Éditeur, Contributeur, Lecteur, Lecture seule) et colore les lignes par niveau de risque. Utile pour un aperçu rapide de la sécurité sans jargon technique.</value></data>
+  <data name="help.perm.merge.title" xml:space="preserve"><value>Fusionner les permissions</value></data>
+  <data name="help.perm.merge.body" xml:space="preserve"><value>Lorsqu'activé, les entrées de permission multiples pour le même utilisateur ou groupe sont regroupées en une seule ligne dans l'export, réduisant la taille du rapport. Désactivez pour voir chaque permission individuellement.</value></data>
+  <data name="help.perm.hidesys.title" xml:space="preserve"><value>Masquer les groupes système</value></data>
+  <data name="help.perm.hidesys.body" xml:space="preserve"><value>Supprime les groupes système créés automatiquement par SharePoint (ex. « Excel Services Viewers », groupes « SharingLinks.* »). Ces groupes sont gérés en interne par SharePoint et ne sont généralement pas pertinents pour les audits d'accès.</value></data>
+  <data name="help.perm.excl.sharing.title" xml:space="preserve"><value>Exclure les liens de partage</value></data>
+  <data name="help.perm.excl.sharing.body" xml:space="preserve"><value>Supprime les entrées de lien de partage des résultats et des exports (ex. « Tout le monde avec le lien », liens à l'échelle de l'organisation). Utile pour ne conserver que les permissions directes des utilisateurs et groupes.</value></data>
+  <data name="help.perm.excl.system.title" xml:space="preserve"><value>Exclure les groupes système (Limited Access)</value></data>
+  <data name="help.perm.excl.system.body" xml:space="preserve"><value>Supprime les entrées « Limited Access System Group For Web/List » des résultats et des exports. SharePoint crée ces groupes automatiquement lorsqu'un utilisateur a accès à un élément spécifique ; ils sont rarement pertinents pour les audits d'accès.</value></data>
+  <data name="help.perm.inherited.title" xml:space="preserve"><value>Inclure les permissions héritées</value></data>
+  <data name="help.perm.inherited.body" xml:space="preserve"><value>Par défaut, seuls les objets avec des permissions uniques (rompues) sont affichés. Activez pour inclure les objets qui héritent les permissions d'un parent et obtenir une vue complète des accès.</value></data>
+  <data name="help.perm.splitmode.title" xml:space="preserve"><value>Mode de fractionnement de l'export</value></data>
+  <data name="help.perm.splitmode.body" xml:space="preserve"><value>Fichier unique : tous les résultats dans un seul fichier CSV ou HTML.
+
+Fractionner par site : crée un fichier séparé pour chaque collection de sites. Utile pour les grandes tenances multi-sites.</value></data>
+  <data name="help.search.title" xml:space="preserve"><value>Recherche de fichiers KQL</value></data>
+  <data name="help.search.body" xml:space="preserve"><value>Recherche des fichiers dans vos sites SharePoint via KQL (Keyword Query Language). Le champ mot-clé est optionnel — laissez-le vide pour retourner tous les fichiers correspondant aux filtres actifs. Combinez les filtres de date, auteur et bibliothèque pour affiner les résultats.</value></data>
+  <data name="help.search.regex.title" xml:space="preserve"><value>Filtre regex sur le nom de fichier</value></data>
+  <data name="help.search.regex.body" xml:space="preserve"><value>Filtre les résultats côté client avec une expression régulière .NET appliquée aux noms de fichiers. Exemple : \.pdf$ correspond uniquement aux PDF. Laissez vide pour ignorer ce filtre. L'expression est insensible à la casse.</value></data>
+  <data name="help.versions.policy.title" xml:space="preserve"><value>Politique de nettoyage des versions</value></data>
+  <data name="help.versions.policy.body" xml:space="preserve"><value>Supprime définitivement les anciennes versions de documents des bibliothèques SharePoint. Seules les N versions les plus récentes sont conservées — les versions plus anciennes sont supprimées de façon permanente et ne peuvent pas être récupérées. Effectuez d'abord une analyse pour prévisualiser les suppressions.</value></data>
+  <data name="help.versions.keepfirst.title" xml:space="preserve"><value>Conserver la première version</value></data>
+  <data name="help.versions.keepfirst.body" xml:space="preserve"><value>Conserve toujours la version 1.0 (originale) de chaque document, indépendamment du paramètre « Conserver les N dernières ». Utile pour maintenir une trace de l'état initial du document.</value></data>
+  <data name="help.versions.confirm.title" xml:space="preserve"><value>Confirmer avant suppression</value></data>
+  <data name="help.versions.confirm.body" xml:space="preserve"><value>Lorsqu'activé, une boîte de dialogue de confirmation apparaît pour chaque fichier avant la suppression des versions. Décochez pour un traitement en lot sans intervention.</value></data>
+  <data name="help.dup.criteria.title" xml:space="preserve"><value>Critères de détection des doublons</value></data>
+  <data name="help.dup.criteria.body" xml:space="preserve"><value>Deux éléments sont identifiés comme doublons quand leurs noms correspondent ET que tous les critères supplémentaires cochés correspondent également. Plus de critères cochés = moins de groupes, mais plus précis. Nom uniquement : trouve les fichiers avec le même nom, quel que soit leur contenu.</value></data>
+  <data name="help.transfer.incsource.title" xml:space="preserve"><value>Inclure le dossier source</value></data>
+  <data name="help.transfer.incsource.body" xml:space="preserve"><value>Lorsqu'activé, le dossier source lui-même est recréé à la destination (ex. transférer « Rapports » crée un dossier « Rapports/ » à la cible). Lorsque désactivé, seul le contenu du dossier est transféré — utile pour fusionner du contenu dans un dossier existant.</value></data>
+  <data name="help.transfer.copycontent.title" xml:space="preserve"><value>Copier uniquement le contenu</value></data>
+  <data name="help.transfer.copycontent.body" xml:space="preserve"><value>Lorsqu'activé, seuls les fichiers et sous-dossiers à l'intérieur du dossier sélectionné sont transférés — le dossier lui-même n'est pas recréé à la destination.</value></data>
+  <data name="help.transfer.conflict.title" xml:space="preserve"><value>Politique de conflit de fichiers</value></data>
+  <data name="help.transfer.conflict.body" xml:space="preserve"><value>Définit ce qui se passe quand un fichier du même nom existe déjà à la destination :
+
+• Ignorer — laisser le fichier destination inchangé.
+• Écraser — remplacer le fichier destination par le fichier source.
+• Renommer — conserver les deux en ajoutant un suffixe numérique au fichier transféré.</value></data>
+  <data name="help.bulkmembers.title" xml:space="preserve"><value>Ajout de membres en masse — Format CSV</value></data>
+  <data name="help.bulkmembers.body" xml:space="preserve"><value>Le fichier CSV doit contenir ces colonnes (en-têtes obligatoires, ordre libre) :
+• GroupName — le nom exact du groupe SharePoint
+• Email — l'adresse e-mail de l'utilisateur
+• Role — Member, Owner ou Visitor
+
+Cliquez sur « Charger l'exemple » pour ouvrir un fichier d'exemple pré-rempli.</value></data>
+  <data name="help.bulksites.title" xml:space="preserve"><value>Création de sites en masse — Format CSV</value></data>
+  <data name="help.bulksites.body" xml:space="preserve"><value>Le fichier CSV doit contenir ces colonnes :
+• Name — le nom d'affichage du nouveau site
+• Alias — alias d'URL (sans espaces ; fait partie de l'URL du site)
+• Type — TeamSite ou CommunicationSite
+• Owners — liste d'adresses e-mail des propriétaires séparées par des virgules
+
+Cliquez sur « Charger l'exemple » pour ouvrir un fichier d'exemple pré-rempli.</value></data>
+  <data name="help.folderstruct.title" xml:space="preserve"><value>Créer une structure de dossiers — Format CSV</value></data>
+  <data name="help.folderstruct.body" xml:space="preserve"><value>Crée une hiérarchie de dossiers dans une bibliothèque SharePoint à partir d'un fichier CSV. Chaque ligne définit un chemin avec jusqu'à 4 niveaux (Level1–Level4). Laissez les colonnes des niveaux inférieurs vides pour des chemins plus courts.
+
+Exemple : Contrats | 2024 | T1 | (vide)
+Crée : Bibliothèque / Contrats / 2024 / T1</value></data>
+  <data name="help.templates.capture.title" xml:space="preserve"><value>Capturer un modèle de site</value></data>
+  <data name="help.templates.capture.body" xml:space="preserve"><value>Enregistre la structure du site sélectionné (bibliothèques, dossiers, permissions, paramètres et logo) comme modèle réutilisable stocké localement. Le site source n'est pas modifié.
+
+Sélectionnez les éléments à capturer avec les cases à cocher ci-dessus.</value></data>
+  <data name="help.templates.apply.title" xml:space="preserve"><value>Appliquer le modèle à un nouveau site</value></data>
+  <data name="help.templates.apply.body" xml:space="preserve"><value>Crée un nouveau site SharePoint et reproduit la structure du modèle sélectionné — bibliothèques, dossiers, permissions, paramètres et logo. Le modèle source et le site d'origine ne sont pas affectés.
+
+Fournissez un nom d'affichage et un alias d'URL avant de cliquer sur Appliquer.</value></data>
+  <data name="help.audit.mode.title" xml:space="preserve"><value>Mode Recherche vs Mode Navigation</value></data>
+  <data name="help.audit.mode.body" xml:space="preserve"><value>Mode Recherche : tapez un nom ou e-mail pour trouver un utilisateur via Azure AD. Les résultats apparaissent dans une liste — cliquez pour sélectionner.
+
+Mode Navigation : charge tous les utilisateurs du répertoire de la tenant. Utilisez le filtre pour trouver un utilisateur, puis double-cliquez pour l'ajouter à l'audit.</value></data>
+  <data name="help.audit.vs.perms.title" xml:space="preserve"><value>Audit d'accès vs Audit des permissions</value></data>
+  <data name="help.audit.vs.perms.body" xml:space="preserve"><value>L'onglet Permissions analyse les objets (bibliothèques, dossiers, éléments) pour montrer qui y a accès.
+
+Cet onglet fait l'inverse : vous sélectionnez un ou plusieurs utilisateurs et il trouve chaque objet auquel ils peuvent accéder — y compris via des groupes SharePoint ou Active Directory.</value></data>
+  <data name="help.storage.hidden.title" xml:space="preserve"><value>Bibliothèques masquées</value></data>
+  <data name="help.storage.hidden.body" xml:space="preserve"><value>Analyse les bibliothèques SharePoint cachées dans la navigation normale du site (ex. Site Assets, Style Library, Form Templates). Elles peuvent consommer beaucoup d'espace et sont souvent oubliées dans les audits de routine.</value></data>
+  <data name="help.storage.preservation.title" xml:space="preserve"><value>Bibliothèque de conservation</value></data>
+  <data name="help.storage.preservation.body" xml:space="preserve"><value>Bibliothèque SharePoint cachée qui stocke les versions de documents modifiés ou supprimés pendant qu'une politique de rétention Microsoft Purview / Microsoft 365 Compliance est active. Elle peut croître considérablement sans être visible pour les utilisateurs du site.</value></data>
 </root>

SharepointToolbox/Localization/Strings.resx

@@ -582,6 +582,9 @@ This cannot be undone.</value>
   <!-- Phase 16: Report Consolidation Toggle -->
   <data name="audit.grp.export" xml:space="preserve"><value>Export Options</value></data>
   <data name="chk.merge.permissions" xml:space="preserve"><value>Merge duplicate permissions</value></data>
+  <data name="chk.hide.system.group.raw" xml:space="preserve"><value>Hide raw system group names (SharingLinks, Limited Access)</value></data>
+  <data name="chk.exclude.sharing.links" xml:space="preserve"><value>Exclude sharing links</value></data>
+  <data name="chk.exclude.system.groups" xml:space="preserve"><value>Exclude system groups (Limited Access)</value></data>
   <!-- Phase 19: App Registration & Removal -->
   <data name="profile.register" xml:space="preserve"><value>Register App</value></data>
   <data name="profile.remove" xml:space="preserve"><value>Remove App</value></data>
@@ -686,6 +689,7 @@ This cannot be undone.</value>
   <data name="report.text.generated" xml:space="preserve"><value>Generated</value></data>
   <data name="report.text.generated_colon" xml:space="preserve"><value>Generated:</value></data>
   <data name="report.text.members_unavailable" xml:space="preserve"><value>members unavailable</value></data>
+  <data name="report.text.empty_group" xml:space="preserve"><value>Empty group</value></data>
   <data name="report.text.link" xml:space="preserve"><value>Link</value></data>
   <data name="report.text.no_ext" xml:space="preserve"><value>(no ext)</value></data>
   <data name="report.text.no_extension" xml:space="preserve"><value>(no extension)</value></data>
@@ -783,4 +787,84 @@ This cannot be undone.</value>
   <data name="report.text.users_parens" xml:space="preserve"><value>user(s)</value></data>
   <data name="report.text.files_unit" xml:space="preserve"><value>files</value></data>
   <data name="report.text.sites_unit" xml:space="preserve"><value>sites</value></data>
+  <data name="report.text.entries_unit" xml:space="preserve"><value>entries</value></data>
+  <!-- Help / Info button strings -->
+  <data name="help.perm.simplified.title" xml:space="preserve"><value>Simplified Permissions Mode</value></data>
+  <data name="help.perm.simplified.body" xml:space="preserve"><value>Groups raw SharePoint permissions into readable labels (Owner, Editor, Contributor, Reader, View-Only) and color-codes rows by risk level. Useful for a quick security overview without permission-level jargon.</value></data>
+  <data name="help.perm.merge.title" xml:space="preserve"><value>Merge Permissions</value></data>
+  <data name="help.perm.merge.body" xml:space="preserve"><value>When enabled, multiple permission entries for the same user or group are consolidated into a single row in the export, reducing report size. Disable to see every individual permission assignment separately.</value></data>
+  <data name="help.perm.hidesys.title" xml:space="preserve"><value>Hide System Groups</value></data>
+  <data name="help.perm.hidesys.body" xml:space="preserve"><value>Removes automatically-created SharePoint system groups from results (e.g. "Excel Services Viewers", "SharingLinks.*" groups). These groups are managed internally by SharePoint and are typically not relevant for user access audits.</value></data>
+  <data name="help.perm.excl.sharing.title" xml:space="preserve"><value>Exclude Sharing Links</value></data>
+  <data name="help.perm.excl.sharing.body" xml:space="preserve"><value>Removes sharing link entries from results and exports (e.g. "Anyone with the link", organisation-wide links). Useful when you only care about direct user and group permissions.</value></data>
+  <data name="help.perm.excl.system.title" xml:space="preserve"><value>Exclude System Groups (Limited Access)</value></data>
+  <data name="help.perm.excl.system.body" xml:space="preserve"><value>Removes "Limited Access System Group For Web/List" entries from results and exports. SharePoint creates these automatically when a user has item-level access; they are rarely relevant for user access audits.</value></data>
+  <data name="help.perm.inherited.title" xml:space="preserve"><value>Include Inherited Permissions</value></data>
+  <data name="help.perm.inherited.body" xml:space="preserve"><value>By default only objects with unique (broken) permissions are reported. Enable this to also include objects that inherit permissions from a parent, giving a complete picture of who can access every item.</value></data>
+  <data name="help.perm.splitmode.title" xml:space="preserve"><value>Export Split Mode</value></data>
+  <data name="help.perm.splitmode.body" xml:space="preserve"><value>Single File: all results are saved in one CSV or HTML file.
+
+Split by Site: creates a separate file for each site collection. Useful when auditing large multi-site tenants to keep individual files manageable.</value></data>
+  <data name="help.search.title" xml:space="preserve"><value>KQL File Search</value></data>
+  <data name="help.search.body" xml:space="preserve"><value>Searches files across your SharePoint sites using KQL (Keyword Query Language). The keyword field is optional — leave it empty to return all files matching only the active filters. Combine date range, author, and library filters to narrow results.</value></data>
+  <data name="help.search.regex.title" xml:space="preserve"><value>Filename Regex Filter</value></data>
+  <data name="help.search.regex.body" xml:space="preserve"><value>Post-filters results client-side using a .NET regular expression matched against file names. Example: \.pdf$ matches only PDF files. Leave blank to skip this filter. The expression is case-insensitive.</value></data>
+  <data name="help.versions.policy.title" xml:space="preserve"><value>Version Cleanup Policy</value></data>
+  <data name="help.versions.policy.body" xml:space="preserve"><value>Permanently deletes old document versions from SharePoint libraries. Only the N most recent versions are kept — older ones are removed permanently and cannot be recovered. Run a preview scan first to see what will be deleted.</value></data>
+  <data name="help.versions.keepfirst.title" xml:space="preserve"><value>Keep First Version</value></data>
+  <data name="help.versions.keepfirst.body" xml:space="preserve"><value>Always preserves version 1.0 (the original) of each document, regardless of the "Keep Last N" setting. Useful to maintain an audit trail of a document's initial state.</value></data>
+  <data name="help.versions.confirm.title" xml:space="preserve"><value>Confirm Before Delete</value></data>
+  <data name="help.versions.confirm.body" xml:space="preserve"><value>When enabled, a confirmation dialog appears for each file before its versions are deleted. Uncheck for unattended batch processing.</value></data>
+  <data name="help.dup.criteria.title" xml:space="preserve"><value>Duplicate Matching Criteria</value></data>
+  <data name="help.dup.criteria.body" xml:space="preserve"><value>Two items are flagged as duplicates when their names match AND all checked additional criteria also match. More criteria checked = fewer groups, but more precise matches. Using name only finds files with the same filename anywhere in the site, regardless of content.</value></data>
+  <data name="help.transfer.incsource.title" xml:space="preserve"><value>Include Source Folder</value></data>
+  <data name="help.transfer.incsource.body" xml:space="preserve"><value>When enabled, the source folder itself is recreated at the destination (e.g. transferring "Reports" creates a "Reports/" folder at the target). When disabled, only the contents inside the folder are transferred — useful when merging into an existing destination folder.</value></data>
+  <data name="help.transfer.copycontent.title" xml:space="preserve"><value>Copy Folder Contents Only</value></data>
+  <data name="help.transfer.copycontent.body" xml:space="preserve"><value>When enabled, only the files and subfolders inside the selected folder are transferred — the selected folder itself is not recreated at the destination.</value></data>
+  <data name="help.transfer.conflict.title" xml:space="preserve"><value>File Conflict Policy</value></data>
+  <data name="help.transfer.conflict.body" xml:space="preserve"><value>Defines what happens when a file with the same name already exists at the destination:
+
+• Skip — leave the existing destination file unchanged.
+• Overwrite — replace the destination file with the source file.
+• Rename — keep both by appending a number suffix to the transferred file's name.</value></data>
+  <data name="help.bulkmembers.title" xml:space="preserve"><value>Bulk Add Members — CSV Format</value></data>
+  <data name="help.bulkmembers.body" xml:space="preserve"><value>The CSV file must contain these columns (headers required, order is flexible):
+• GroupName — the exact SharePoint group name
+• Email — the user's email address
+• Role — Member, Owner, or Visitor
+
+Click "Load Example" to open a pre-filled sample file.</value></data>
+  <data name="help.bulksites.title" xml:space="preserve"><value>Bulk Create Sites — CSV Format</value></data>
+  <data name="help.bulksites.body" xml:space="preserve"><value>The CSV file must contain these columns:
+• Name — the display name for the new site
+• Alias — URL alias (no spaces; becomes part of the site URL)
+• Type — TeamSite or CommunicationSite
+• Owners — comma-separated list of owner email addresses
+
+Click "Load Example" to open a pre-filled sample file.</value></data>
+  <data name="help.folderstruct.title" xml:space="preserve"><value>Create Folder Structure — CSV Format</value></data>
+  <data name="help.folderstruct.body" xml:space="preserve"><value>Creates a folder hierarchy inside a SharePoint library from a CSV file. Each row defines one folder path using up to 4 levels (Level1–Level4). Leave deeper level columns empty for shallower paths.
+
+Example row: Contracts | 2024 | Q1 | (empty)
+Creates: Library / Contracts / 2024 / Q1</value></data>
+  <data name="help.templates.capture.title" xml:space="preserve"><value>Capture Site Template</value></data>
+  <data name="help.templates.capture.body" xml:space="preserve"><value>Saves the currently selected site's structure (libraries, folder hierarchy, permissions, settings, and logo) as a reusable template stored locally on your machine. The source site is not modified in any way.
+
+Select which elements to include using the checkboxes above.</value></data>
+  <data name="help.templates.apply.title" xml:space="preserve"><value>Apply Template to New Site</value></data>
+  <data name="help.templates.apply.body" xml:space="preserve"><value>Creates a brand-new SharePoint site and reproduces the structure captured in the selected template — including libraries, folders, permissions, settings, and logo. The source template and original site are not affected.
+
+Provide a display name and URL alias for the new site before clicking Apply.</value></data>
+  <data name="help.audit.mode.title" xml:space="preserve"><value>Search vs Browse Mode</value></data>
+  <data name="help.audit.mode.body" xml:space="preserve"><value>Search Mode: type a name or email to find a specific user via Azure AD. Matching users appear in a list — click to select them for the audit.
+
+Browse Mode: loads all users in your tenant directory. Use the filter box to narrow the list, then double-click a row to add the user to the audit.</value></data>
+  <data name="help.audit.vs.perms.title" xml:space="preserve"><value>User Access Audit vs Permissions Audit</value></data>
+  <data name="help.audit.vs.perms.body" xml:space="preserve"><value>The Permissions tab scans objects (libraries, folders, items) and shows who has access to each one.
+
+This tab does the reverse: you select one or more users and it finds every object they can access — including access granted via SharePoint groups or Active Directory groups.</value></data>
+  <data name="help.storage.hidden.title" xml:space="preserve"><value>Hidden Libraries</value></data>
+  <data name="help.storage.hidden.body" xml:space="preserve"><value>Scans SharePoint libraries hidden from the site's normal navigation (e.g. Site Assets, Style Library, Form Templates). These can consume significant storage and are often overlooked in routine audits.</value></data>
+  <data name="help.storage.preservation.title" xml:space="preserve"><value>Preservation Hold Library</value></data>
+  <data name="help.storage.preservation.body" xml:space="preserve"><value>A hidden SharePoint library that stores versions of documents modified or deleted while a Microsoft Purview / Microsoft 365 Compliance retention policy is active. It can grow very large over time without being visible to normal site users.</value></data>
 </root>

SharepointToolbox/Services/BulkMemberService.cs

@@ -64,6 +64,7 @@ public class BulkMemberService : IBulkMemberService
                 return;
             }
         }
+        catch (OperationCanceledException) { throw; }
         catch (Exception ex)
         {
             Log.Warning("Graph API failed for {GroupUrl}, falling back to CSOM: {Error}",
@@ -83,7 +84,7 @@ public class BulkMemberService : IBulkMemberService
     {
         // Resolve user by email
         var user = await graphClient.Users[email].GetAsync(cancellationToken: ct);
-        if (user == null)
+        if (user?.Id == null)
             throw new InvalidOperationException($"User not found: {email}");
 
         var userRef = $"https://graph.microsoft.com/v1.0/directoryObjects/{user.Id}";
@@ -138,13 +139,16 @@ public class BulkMemberService : IBulkMemberService
                         }
                     }
                 }
-                catch { /* not a group-connected site */ }
+                catch (OperationCanceledException) { throw; }
+                catch (Exception ex) { Log.Debug("Group lookup not available for {SiteUrl}: {Error}", siteUrl, ex.Message); }
             }
 
             return null;
         }
-        catch
+        catch (OperationCanceledException) { throw; }
+        catch (Exception ex)
         {
+            Log.Debug("Could not resolve M365 group ID for {SiteUrl}: {Error}", siteUrl, ex.Message);
             return null;
         }
     }

SharepointToolbox/Services/BulkSiteService.cs

@@ -54,6 +54,9 @@ public class BulkSiteService : IBulkSiteService
         var owners = ParseEmails(row.Owners);
         var members = ParseEmails(row.Members);
 
+        if (owners.Count == 0)
+            throw new InvalidOperationException($"Team site '{row.Name}' requires at least one owner.");
+
         var creationInfo = new TeamSiteCollectionCreationInformation
         {
             DisplayName = row.Name,
@@ -88,6 +91,7 @@ public class BulkSiteService : IBulkSiteService
                     membersGroup.Users.AddUser(user);
                     await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(siteCtx, progress, ct);
                 }
+                catch (OperationCanceledException) { throw; }
                 catch (Exception ex)
                 {
                     Log.Warning("Failed to add member {Email} to {Site}: {Error}",
@@ -142,6 +146,7 @@ public class BulkSiteService : IBulkSiteService
                 ownersGroup.Users.AddUser(user);
                 await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(siteCtx, progress, ct);
             }
+            catch (OperationCanceledException) { throw; }
             catch (Exception ex)
             {
                 Log.Warning("Failed to add owner {Email} to {Site}: {Error}",
@@ -162,6 +167,7 @@ public class BulkSiteService : IBulkSiteService
                 membersGroup.Users.AddUser(user);
                 await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(siteCtx, progress, ct);
             }
+            catch (OperationCanceledException) { throw; }
             catch (Exception ex)
             {
                 Log.Warning("Failed to add member {Email} to {Site}: {Error}",

SharepointToolbox/Services/Export/CsvExportService.cs

@@ -14,7 +14,7 @@ public class CsvExportService
     private static string BuildHeader()
     {
         var T = TranslationSource.Instance;
-        return $"\"{T["report.col.object"]}\",\"{T["report.col.title"]}\",\"{T["report.col.url"]}\",\"HasUniquePermissions\",\"Users\",\"UserLogins\",\"Type\",\"Permissions\",\"GrantedThrough\"";
+        return $"\"{T["report.col.object"]}\",\"{T["report.col.title"]}\",\"{T["report.col.url"]}\",\"HasUniquePermissions\",\"Users\",\"UserLogins\",\"Type\",\"Permissions\",\"GrantedThrough\",\"TargetLabel\",\"TargetUrl\",\"SharingLinkType\"";
     }
 
     /// <summary>
@@ -39,7 +39,10 @@ public class CsvExportService
                 UserLogins    = g.First().UserLogins,
                 PrincipalType = g.First().PrincipalType,
                 Permissions   = g.Key.PermissionLevels,
-                GrantedThrough = g.Key.GrantedThrough
+                GrantedThrough = g.Key.GrantedThrough,
+                TargetLabel   = g.First().TargetLabel ?? string.Empty,
+                TargetUrl     = g.First().TargetUrl ?? string.Empty,
+                SharingLinkType = g.First().SharingLinkType ?? string.Empty
             });
 
         foreach (var row in merged)
@@ -47,7 +50,8 @@ public class CsvExportService
             {
                 Csv(row.ObjectType), Csv(row.Title), Csv(row.Url),
                 Csv(row.HasUnique.ToString()), Csv(row.Users), Csv(row.UserLogins),
-                Csv(row.PrincipalType), Csv(row.Permissions), Csv(row.GrantedThrough)
+                Csv(row.PrincipalType), Csv(row.Permissions), Csv(row.GrantedThrough),
+                Csv(row.TargetLabel), Csv(row.TargetUrl), Csv(row.SharingLinkType)
             }));
 
         return sb.ToString();
@@ -68,7 +72,7 @@ public class CsvExportService
     private static string BuildSimplifiedHeader()
     {
         var T = TranslationSource.Instance;
-        return $"\"{T["report.col.object"]}\",\"{T["report.col.title"]}\",\"{T["report.col.url"]}\",\"HasUniquePermissions\",\"Users\",\"UserLogins\",\"Type\",\"Permissions\",\"SimplifiedLabels\",\"RiskLevel\",\"GrantedThrough\"";
+        return $"\"{T["report.col.object"]}\",\"{T["report.col.title"]}\",\"{T["report.col.url"]}\",\"HasUniquePermissions\",\"Users\",\"UserLogins\",\"Type\",\"Permissions\",\"SimplifiedLabels\",\"RiskLevel\",\"GrantedThrough\",\"TargetLabel\",\"TargetUrl\",\"SharingLinkType\"";
     }
 
     /// <summary>
@@ -95,7 +99,10 @@ public class CsvExportService
                 Permissions    = g.Key.PermissionLevels,
                 SimplifiedLabels = g.First().SimplifiedLabels,
                 RiskLevel      = g.First().RiskLevel.ToString(),
-                GrantedThrough = g.Key.GrantedThrough
+                GrantedThrough = g.Key.GrantedThrough,
+                TargetLabel    = g.First().TargetLabel ?? string.Empty,
+                TargetUrl      = g.First().TargetUrl ?? string.Empty,
+                SharingLinkType = g.First().SharingLinkType ?? string.Empty
             });
 
         foreach (var row in merged)
@@ -104,7 +111,8 @@ public class CsvExportService
                 Csv(row.ObjectType), Csv(row.Title), Csv(row.Url),
                 Csv(row.HasUnique.ToString()), Csv(row.Users), Csv(row.UserLogins),
                 Csv(row.PrincipalType), Csv(row.Permissions), Csv(row.SimplifiedLabels),
-                Csv(row.RiskLevel), Csv(row.GrantedThrough)
+                Csv(row.RiskLevel), Csv(row.GrantedThrough),
+                Csv(row.TargetLabel), Csv(row.TargetUrl), Csv(row.SharingLinkType)
             }));
 
         return sb.ToString();

SharepointToolbox/Services/Export/HtmlExportService.cs

@@ -27,7 +27,8 @@ public class HtmlExportService
     public string BuildHtml(
         IReadOnlyList<PermissionEntry> entries,
         ReportBranding? branding = null,
-        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null)
+        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null,
+        bool hideSystemGroupRaw = false)
     {
         var T = TranslationSource.Instance;
         var (totalEntries, uniquePermSets, distinctUsers) = ComputeStats(
@@ -57,7 +58,9 @@ public class HtmlExportService
 
             var (pills, subRows) = BuildUserPillsCell(
                 entry.UserLogins, entry.Users, entry.PrincipalType, groupMembers,
-                colSpan: 7, grpMemIdx: ref grpMemIdx);
+                colSpan: 7, grpMemIdx: ref grpMemIdx,
+                targetLabel: entry.TargetLabel, sharingLinkType: entry.SharingLinkType,
+                hideSystemGroupRaw: hideSystemGroupRaw);
 
             sb.AppendLine("<tr>");
             sb.AppendLine($"  <td><span class=\"{typeCss}\">{HtmlEncode(entry.ObjectType)}</span></td>");
@@ -66,7 +69,7 @@ public class HtmlExportService
             sb.AppendLine($"  <td><span class=\"{uniqueCss}\">{uniqueLbl}</span></td>");
             sb.AppendLine($"  <td>{pills}</td>");
             sb.AppendLine($"  <td>{HtmlEncode(entry.PermissionLevels)}</td>");
-            sb.AppendLine($"  <td>{HtmlEncode(entry.GrantedThrough)}</td>");
+            sb.AppendLine($"  <td>{BuildGrantedThroughCell(entry.GrantedThrough, entry.TargetUrl, entry.TargetLabel, entry.SharingLinkType, hideSystemGroupRaw)}</td>");
             sb.AppendLine("</tr>");
             if (subRows.Length > 0) sb.Append(subRows);
         }
@@ -87,7 +90,8 @@ public class HtmlExportService
     public string BuildHtml(
         IReadOnlyList<SimplifiedPermissionEntry> entries,
         ReportBranding? branding = null,
-        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null)
+        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null,
+        bool hideSystemGroupRaw = false)
     {
         var T = TranslationSource.Instance;
         var summaries = PermissionSummaryBuilder.Build(entries);
@@ -118,35 +122,47 @@ public class HtmlExportService
         AppendFilterInput(sb);
         AppendTableOpen(sb);
         sb.AppendLine("<thead><tr>");
-        sb.AppendLine($"  <th>{T["report.col.object"]}</th><th>{T["report.col.title"]}</th><th>{T["report.col.url"]}</th><th>{T["report.badge.unique"]}</th><th>{T["report.col.users_groups"]}</th><th>{T["report.col.permission_level"]}</th><th>{T["report.col.simplified"]}</th><th>{T["report.col.risk"]}</th><th>{T["report.col.granted_through"]}</th>");
+        sb.AppendLine($"  <th>{T["report.col.users_groups"]}</th><th>{T["report.col.permission_level"]}</th><th>{T["report.col.simplified"]}</th><th>{T["report.col.risk"]}</th><th>{T["report.col.granted_through"]}</th>");
         sb.AppendLine("</tr></thead>");
         sb.AppendLine("<tbody>");
 
         int grpMemIdx = 0;
-        foreach (var entry in entries)
+        int sectionIdx = 0;
+        var groups = entries.GroupBy(e => (e.ObjectType, e.Title, e.Url)).ToList();
+        foreach (var group in groups)
+        {
+            var sectionId = $"sec{sectionIdx++}";
+            var first     = group.First();
+            var typeCss   = ObjectTypeCss(group.Key.ObjectType);
+            var uniqueCss = first.HasUniquePermissions ? "badge unique" : "badge inherited";
+            var uniqueLbl = first.HasUniquePermissions ? T["report.badge.unique"] : T["report.badge.inherited"];
+            var count     = group.Count();
+
+            sb.AppendLine($"<tr class=\"section-header collapsed\" data-section=\"{sectionId}\">");
+            sb.AppendLine($"  <td colspan=\"5\"><span class=\"chevron\">&#9660;</span><span class=\"{typeCss}\">{HtmlEncode(group.Key.ObjectType)}</span> <strong>{HtmlEncode(group.Key.Title)}</strong> <a href=\"{HtmlEncode(group.Key.Url)}\" target=\"_blank\">&#8599;</a> <span class=\"{uniqueCss}\">{uniqueLbl}</span><span class=\"entry-badge\">{count} {T["report.text.entries_unit"]}</span></td>");
+            sb.AppendLine("</tr>");
+
+            foreach (var entry in group)
             {
-            var typeCss   = ObjectTypeCss(entry.ObjectType);
-            var uniqueCss = entry.HasUniquePermissions ? "badge unique" : "badge inherited";
-            var uniqueLbl = entry.HasUniquePermissions ? T["report.badge.unique"] : T["report.badge.inherited"];
                 var (riskBg, riskText, riskBorder) = RiskLevelColors(entry.RiskLevel);
 
                 var (pills, subRows) = BuildUserPillsCell(
                     entry.UserLogins, entry.Inner.Users, entry.Inner.PrincipalType, groupMembers,
-                colSpan: 9, grpMemIdx: ref grpMemIdx);
+                    colSpan: 5, grpMemIdx: ref grpMemIdx,
+                    targetLabel: entry.TargetLabel, sharingLinkType: entry.SharingLinkType,
+                    hideSystemGroupRaw: hideSystemGroupRaw,
+                    sectionId: sectionId);
 
-            sb.AppendLine("<tr>");
-            sb.AppendLine($"  <td><span class=\"{typeCss}\">{HtmlEncode(entry.ObjectType)}</span></td>");
-            sb.AppendLine($"  <td>{HtmlEncode(entry.Title)}</td>");
-            sb.AppendLine($"  <td><a href=\"{HtmlEncode(entry.Url)}\" target=\"_blank\">{T["report.text.link"]}</a></td>");
-            sb.AppendLine($"  <td><span class=\"{uniqueCss}\">{uniqueLbl}</span></td>");
+                sb.AppendLine($"<tr data-section-member=\"{sectionId}\" style=\"display:none\">");
                 sb.AppendLine($"  <td>{pills}</td>");
                 sb.AppendLine($"  <td>{HtmlEncode(entry.PermissionLevels)}</td>");
                 sb.AppendLine($"  <td>{HtmlEncode(entry.SimplifiedLabels)}</td>");
                 sb.AppendLine($"  <td><span class=\"risk-badge\" style=\"background:{riskBg};color:{riskText};border-color:{riskBorder}\">{HtmlEncode(entry.RiskLevel.ToString())}</span></td>");
-            sb.AppendLine($"  <td>{HtmlEncode(entry.GrantedThrough)}</td>");
+                sb.AppendLine($"  <td>{BuildGrantedThroughCell(entry.GrantedThrough, entry.TargetUrl, entry.TargetLabel, entry.SharingLinkType, hideSystemGroupRaw)}</td>");
                 sb.AppendLine("</tr>");
                 if (subRows.Length > 0) sb.Append(subRows);
             }
+        }
 
         AppendTableClose(sb);
         AppendInlineJs(sb);
@@ -161,9 +177,10 @@ public class HtmlExportService
         string filePath,
         CancellationToken ct,
         ReportBranding? branding = null,
-        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null)
+        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null,
+        bool hideSystemGroupRaw = false)
     {
-        var html = BuildHtml(entries, branding, groupMembers);
+        var html = BuildHtml(entries, branding, groupMembers, hideSystemGroupRaw);
         await ExportFileWriter.WriteHtmlAsync(filePath, html, ct);
     }
 
@@ -173,9 +190,10 @@ public class HtmlExportService
         string filePath,
         CancellationToken ct,
         ReportBranding? branding = null,
-        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null)
+        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null,
+        bool hideSystemGroupRaw = false)
     {
-        var html = BuildHtml(entries, branding, groupMembers);
+        var html = BuildHtml(entries, branding, groupMembers, hideSystemGroupRaw);
         await ExportFileWriter.WriteHtmlAsync(filePath, html, ct);
     }
 
@@ -191,11 +209,12 @@ public class HtmlExportService
         HtmlSplitLayout layout,
         CancellationToken ct,
         ReportBranding? branding = null,
-        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null)
+        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null,
+        bool hideSystemGroupRaw = false)
     {
         if (splitMode != ReportSplitMode.BySite)
         {
-            await WriteAsync(entries, basePath, ct, branding, groupMembers);
+            await WriteAsync(entries, basePath, ct, branding, groupMembers, hideSystemGroupRaw);
             return;
         }
 
@@ -203,7 +222,7 @@ public class HtmlExportService
         if (layout == HtmlSplitLayout.SingleTabbed)
         {
             var parts = partitions
-                .Select(p => (p.Label, Html: BuildHtml(p.Partition, branding, groupMembers)))
+                .Select(p => (p.Label, Html: BuildHtml(p.Partition, branding, groupMembers, hideSystemGroupRaw)))
                 .ToList();
             var title = TranslationSource.Instance["report.title.permissions"];
             var tabbed = ReportSplitHelper.BuildTabbedHtml(parts, title);
@@ -215,11 +234,11 @@ public class HtmlExportService
         {
             ct.ThrowIfCancellationRequested();
             var path = ReportSplitHelper.BuildPartitionPath(basePath, label);
-            await WriteAsync(partEntries, path, ct, branding, groupMembers);
+            await WriteAsync(partEntries, path, ct, branding, groupMembers, hideSystemGroupRaw);
         }
     }
 
-    /// <summary>Simplified-entry split variant of <see cref="WriteAsync(IReadOnlyList{PermissionEntry}, string, ReportSplitMode, HtmlSplitLayout, CancellationToken, ReportBranding?, IReadOnlyDictionary{string, IReadOnlyList{ResolvedMember}}?)"/>.</summary>
+    /// <summary>Simplified-entry split variant.</summary>
     public async Task WriteAsync(
         IReadOnlyList<SimplifiedPermissionEntry> entries,
         string basePath,
@@ -227,11 +246,12 @@ public class HtmlExportService
         HtmlSplitLayout layout,
         CancellationToken ct,
         ReportBranding? branding = null,
-        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null)
+        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null,
+        bool hideSystemGroupRaw = false)
     {
         if (splitMode != ReportSplitMode.BySite)
         {
-            await WriteAsync(entries, basePath, ct, branding, groupMembers);
+            await WriteAsync(entries, basePath, ct, branding, groupMembers, hideSystemGroupRaw);
             return;
         }
 
@@ -239,7 +259,7 @@ public class HtmlExportService
         if (layout == HtmlSplitLayout.SingleTabbed)
         {
             var parts = partitions
-                .Select(p => (p.Label, Html: BuildHtml(p.Partition, branding, groupMembers)))
+                .Select(p => (p.Label, Html: BuildHtml(p.Partition, branding, groupMembers, hideSystemGroupRaw)))
                 .ToList();
             var title = TranslationSource.Instance["report.title.permissions_simplified"];
             var tabbed = ReportSplitHelper.BuildTabbedHtml(parts, title);
@@ -251,7 +271,7 @@ public class HtmlExportService
         {
             ct.ThrowIfCancellationRequested();
             var path = ReportSplitHelper.BuildPartitionPath(basePath, label);
-            await WriteAsync(partEntries, path, ct, branding, groupMembers);
+            await WriteAsync(partEntries, path, ct, branding, groupMembers, hideSystemGroupRaw);
         }
     }
 

SharepointToolbox/Services/Export/PermissionHtmlFragments.cs

@@ -1,4 +1,5 @@
 using System.Text;
+using SharepointToolbox.Core.Helpers;
 using SharepointToolbox.Core.Models;
 using SharepointToolbox.Localization;
 
@@ -51,17 +52,62 @@ a:hover { text-decoration: underline; }
 .risk-card .rlabel { font-size: .8rem; margin-top: 2px; }
 .risk-card .users { font-size: .7rem; margin-top: 2px; opacity: 0.8; }
 .risk-badge { display: inline-block; padding: 2px 8px; border-radius: 4px; font-size: .75rem; font-weight: 600; border: 1px solid; }
+.section-header td { background: #edf2f7; font-weight: 600; cursor: pointer; padding: 8px 14px; border-bottom: 2px solid #cbd5e0; user-select: none; }
+.section-header:hover td { background: #e2e8f0; }
+.section-header .chevron { margin-right: 8px; display: inline-block; transition: transform 0.15s; }
+.section-header.collapsed .chevron { transform: rotate(-90deg); }
+.entry-badge { display: inline-block; background: #e2e8f0; color: #4a5568; border-radius: 10px; padding: 1px 8px; font-size: .75rem; font-weight: 600; margin-left: 8px; }
 ";
 
     internal const string InlineJs = @"function filterTable() {
   var input = document.getElementById('filter').value.toLowerCase();
-  var rows = document.querySelectorAll('#permTable tbody tr');
-  rows.forEach(function(row) {
+  var sections = document.querySelectorAll('#permTable tbody tr.section-header');
+  if (sections.length === 0) {
+    document.querySelectorAll('#permTable tbody tr').forEach(function(row) {
       if (row.hasAttribute('data-group')) return;
       row.style.display = row.textContent.toLowerCase().indexOf(input) > -1 ? '' : 'none';
     });
+    return;
+  }
+  if (!input) {
+    sections.forEach(function(hdr) {
+      hdr.style.display = '';
+      var sid = hdr.getAttribute('data-section');
+      var collapsed = hdr.classList.contains('collapsed');
+      document.querySelectorAll('[data-section-member=' + sid + ']:not([data-group])').forEach(function(r) {
+        r.style.display = collapsed ? 'none' : '';
+      });
+    });
+    return;
+  }
+  sections.forEach(function(hdr) {
+    var sid = hdr.getAttribute('data-section');
+    var members = document.querySelectorAll('[data-section-member=' + sid + ']:not([data-group])');
+    var anyMatch = false;
+    members.forEach(function(r) {
+      var match = r.textContent.toLowerCase().indexOf(input) > -1;
+      r.style.display = match ? '' : 'none';
+      if (match) anyMatch = true;
+    });
+    if (!anyMatch && hdr.textContent.toLowerCase().indexOf(input) > -1) {
+      anyMatch = true;
+      members.forEach(function(r) { r.style.display = ''; });
+    }
+    hdr.style.display = anyMatch ? '' : 'none';
+  });
 }
 document.addEventListener('click', function(ev) {
+  var hdr = ev.target.closest('.section-header');
+  if (hdr) {
+    var sid = hdr.getAttribute('data-section');
+    hdr.classList.toggle('collapsed');
+    var collapsed = hdr.classList.contains('collapsed');
+    document.querySelectorAll('[data-section-member=' + sid + ']').forEach(function(r) {
+      if (r.hasAttribute('data-group')) { r.style.display = 'none'; return; }
+      r.style.display = collapsed ? 'none' : '';
+    });
+    return;
+  }
   var trigger = ev.target.closest('.group-expandable');
   if (!trigger) return;
   var id = trigger.getAttribute('data-group-target');
@@ -137,7 +183,11 @@ document.addEventListener('click', function(ev) {
         string? principalType,
         IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers,
         int colSpan,
-        ref int grpMemIdx)
+        ref int grpMemIdx,
+        string? targetLabel = null,
+        string? sharingLinkType = null,
+        bool hideSystemGroupRaw = false,
+        string? sectionId = null)
     {
         var T = TranslationSource.Instance;
         var logins = userLogins.Split(';', StringSplitOptions.RemoveEmptyEntries);
@@ -151,28 +201,75 @@ document.addEventListener('click', function(ev) {
             var name  = i < names.Length ? names[i].Trim() : login;
             var isExt = login.Contains("#EXT#", StringComparison.OrdinalIgnoreCase);
 
-            bool isExpandable = principalType == "SharePointGroup"
+            // When the principal is a resolved system group and the user wants the raw
+            // name hidden, replace the pill's visible text with the link-type badge
+            // (sharing links) and/or the target label. Falls back to the raw name when
+            // resolution failed (no targetLabel).
+            var classification = principalType == "SharePointGroup"
+                ? PermissionEntryHelper.Classify(name)
+                : new SystemGroupClassification(SystemGroupKind.None, null, null, null, null, null);
+            bool isResolvedSystemGroup = hideSystemGroupRaw
+                && classification.Kind != SystemGroupKind.None
+                && classification.Kind != SystemGroupKind.LimitedAccessBare
+                && !string.IsNullOrEmpty(targetLabel);
+
+            bool hasResolvedMembers = principalType == "SharePointGroup"
                 && groupMembers != null
                 && groupMembers.TryGetValue(name, out _);
 
-            if (isExpandable && groupMembers != null && groupMembers.TryGetValue(name, out var resolved))
+            if (hasResolvedMembers && groupMembers!.TryGetValue(name, out var resolved))
             {
-                var grpId = $"grpmem{grpMemIdx}";
-                pills.Append($"<span class=\"user-pill group-expandable\" data-group-target=\"{HtmlEncode(grpId)}\" data-email=\"{HtmlEncode(login)}\">{HtmlEncode(name)} &#9660;</span>");
-
-                string memberContent;
-                if (resolved.Count > 0)
+                if (resolved.Count == 0)
                 {
-                    var parts = resolved.Select(m => $"{HtmlEncode(m.DisplayName)} &lt;{HtmlEncode(m.Login)}&gt;");
-                    memberContent = string.Join(" &bull; ", parts);
+                    // Members unavailable — render plain pill, skip expandable sub-row.
+                    var cls2 = isResolvedSystemGroup ? "user-pill\" data-system-group=\"1" : "user-pill";
+                    pills.Append($"<span class=\"{cls2}\" title=\"{HtmlEncode(T["report.text.empty_group"])}\" data-email=\"{HtmlEncode(login)}\">");
+                    if (isResolvedSystemGroup)
+                    {
+                        if (!string.IsNullOrEmpty(sharingLinkType))
+                            pills.Append(BuildSharingLinkBadge(sharingLinkType!));
+                        pills.Append(HtmlEncode(targetLabel!));
                     }
                     else
                     {
-                    memberContent = $"<em style=\"color:#888\">{T["report.text.members_unavailable"]}</em>";
+                        pills.Append(HtmlEncode(name));
                     }
-                subRows.AppendLine($"<tr data-group=\"{HtmlEncode(grpId)}\" style=\"display:none\"><td colspan=\"{colSpan}\" style=\"padding-left:2em;font-size:.8rem;color:#555\">{memberContent}</td></tr>");
+                    pills.Append("</span>");
+                }
+                else
+                {
+                    var grpId = $"grpmem{grpMemIdx}";
+                    pills.Append("<span class=\"user-pill group-expandable\"");
+                    if (isResolvedSystemGroup)
+                        pills.Append(" data-system-group=\"1\"");
+                    pills.Append($" data-group-target=\"{HtmlEncode(grpId)}\" data-email=\"{HtmlEncode(login)}\">");
+                    if (isResolvedSystemGroup)
+                    {
+                        if (!string.IsNullOrEmpty(sharingLinkType))
+                            pills.Append(BuildSharingLinkBadge(sharingLinkType!));
+                        pills.Append(HtmlEncode(targetLabel!));
+                    }
+                    else
+                    {
+                        pills.Append(HtmlEncode(name));
+                    }
+                    pills.Append(" &#9660;</span>");
+
+                    var parts = resolved.Select(m => $"{HtmlEncode(m.DisplayName)} &lt;{HtmlEncode(m.Login)}&gt;");
+                    var memberContent = string.Join(" &bull; ", parts);
+                    var sectionAttr = sectionId != null ? $" data-section-member=\"{HtmlEncode(sectionId)}\"" : "";
+                    subRows.AppendLine($"<tr data-group=\"{HtmlEncode(grpId)}\"{sectionAttr} style=\"display:none\"><td colspan=\"{colSpan}\" style=\"padding-left:2em;font-size:.8rem;color:#555\">{memberContent}</td></tr>");
                     grpMemIdx++;
                 }
+            }
+            else if (isResolvedSystemGroup)
+            {
+                pills.Append("<span class=\"user-pill\" data-system-group=\"1\">");
+                if (!string.IsNullOrEmpty(sharingLinkType))
+                    pills.Append(BuildSharingLinkBadge(sharingLinkType!));
+                pills.Append(HtmlEncode(targetLabel!));
+                pills.Append("</span>");
+            }
             else
             {
                 var cls = isExt ? "user-pill external-user" : "user-pill";
@@ -183,6 +280,80 @@ document.addEventListener('click', function(ev) {
         return (pills.ToString(), subRows.ToString());
     }
 
+    /// <summary>
+    /// Renders the Granted Through cell. When the entry carries a resolved system-group
+    /// target (Limited Access For Web/List or SharingLinks), a clickable link to the
+    /// targeted resource is appended on a second line. For sharing links the link type
+    /// (OrganizationEdit / AnonymousView / …) is surfaced alongside the target.
+    ///
+    /// When <paramref name="hideSystemGroupRaw"/> is true and a target was resolved, the
+    /// raw "SharePoint Group: SharingLinks.{guid}…" / "Limited Access System Group For
+    /// Web|List {guid}" prefix is suppressed and only the link-type badge + clickable
+    /// target are shown — keeps the report readable without losing information.
+    /// </summary>
+    internal static string BuildGrantedThroughCell(
+        string grantedThrough,
+        string? targetUrl,
+        string? targetLabel,
+        string? sharingLinkType,
+        bool hideSystemGroupRaw = false)
+    {
+        var hasTarget = !string.IsNullOrEmpty(targetUrl) && !string.IsNullOrEmpty(targetLabel);
+        var hasLinkType = !string.IsNullOrEmpty(sharingLinkType);
+        var suppressRaw = hideSystemGroupRaw && hasTarget;
+
+        var sb = new StringBuilder();
+        if (!suppressRaw)
+            sb.Append(HtmlEncode(grantedThrough));
+
+        if (!hasTarget && !hasLinkType)
+            return sb.ToString();
+
+        if (suppressRaw)
+        {
+            // Inline layout — no leading raw text to wrap under.
+            if (hasLinkType)
+                sb.Append(BuildSharingLinkBadge(sharingLinkType!));
+            if (hasTarget)
+            {
+                sb.Append("<a href=\"");
+                sb.Append(HtmlEncode(targetUrl!));
+                sb.Append("\" target=\"_blank\">");
+                sb.Append(HtmlEncode(targetLabel!));
+                sb.Append("</a>");
+            }
+            return sb.ToString();
+        }
+
+        sb.Append("<div style=\"margin-top:4px;font-size:.75rem;color:#555\">");
+        if (hasLinkType)
+            sb.Append(BuildSharingLinkBadge(sharingLinkType!));
+        if (hasTarget)
+        {
+            sb.Append("&rarr; <a href=\"");
+            sb.Append(HtmlEncode(targetUrl!));
+            sb.Append("\" target=\"_blank\">");
+            sb.Append(HtmlEncode(targetLabel!));
+            sb.Append("</a>");
+        }
+        sb.Append("</div>");
+        return sb.ToString();
+    }
+
+    /// <summary>
+    /// Builds the colored badge for a SharePoint sharing-link type. Translates the
+    /// raw <c>linkType</c> code (e.g. <c>OrganizationEdit</c>) into a human label
+    /// (e.g. <c>Org link · Edit</c>) and tints by risk tier; raw code surfaces as a
+    /// <c>title</c> tooltip so operators can still trace it back to the source.
+    /// </summary>
+    internal static string BuildSharingLinkBadge(string rawLinkType)
+    {
+        var (label, risk) = SharingLinkLabels.Describe(rawLinkType);
+        var (bg, fg) = SharingLinkLabels.Colors(risk);
+        return $"<span class=\"badge\" style=\"background:{bg};color:{fg};margin-right:6px\" " +
+               $"title=\"{HtmlEncode(rawLinkType)}\">{HtmlEncode(label)}</span>";
+    }
+
     /// <summary>Returns the CSS class for the object-type badge.</summary>
     internal static string ObjectTypeCss(string t) => t switch
     {

SharepointToolbox/Services/Export/UserAccessCsvExportService.cs

@@ -15,7 +15,7 @@ public class UserAccessCsvExportService
     private static string BuildDataHeader()
     {
         var T = TranslationSource.Instance;
-        return $"\"{T["report.col.site"]}\",\"{T["report.col.object_type"]}\",\"{T["report.col.object"]}\",\"{T["report.col.url"]}\",\"{T["report.col.permission_level"]}\",\"{T["report.col.access_type"]}\",\"{T["report.col.granted_through"]}\"";
+        return $"\"{T["report.col.site"]}\",\"{T["report.col.object_type"]}\",\"{T["report.col.object"]}\",\"{T["report.col.url"]}\",\"{T["report.col.permission_level"]}\",\"{T["report.col.access_type"]}\",\"{T["report.col.granted_through"]}\",\"TargetLabel\",\"TargetUrl\",\"SharingLinkType\"";
     }
 
     /// <summary>
@@ -51,7 +51,10 @@ public class UserAccessCsvExportService
                 Csv(entry.ObjectUrl),
                 Csv(entry.PermissionLevel),
                 Csv(entry.AccessType.ToString()),
-                Csv(entry.GrantedThrough)
+                Csv(entry.GrantedThrough),
+                Csv(entry.TargetLabel ?? string.Empty),
+                Csv(entry.TargetUrl ?? string.Empty),
+                Csv(entry.SharingLinkType ?? string.Empty)
             }));
         }
 
@@ -179,7 +182,7 @@ public class UserAccessCsvExportService
             sb.AppendLine();
 
             // Header
-            sb.AppendLine($"\"{T["report.col.user"]}\",\"User Login\",\"{T["report.col.permission_level"]}\",\"{T["report.col.access_type"]}\",\"{T["report.col.granted_through"]}\",\"Locations\",\"Location Count\"");
+            sb.AppendLine($"\"{T["report.col.user"]}\",\"User Login\",\"{T["report.col.permission_level"]}\",\"{T["report.col.access_type"]}\",\"{T["report.col.granted_through"]}\",\"TargetLabel\",\"TargetUrl\",\"SharingLinkType\",\"Locations\",\"Location Count\"");
 
             // Data rows
             foreach (var entry in consolidated)
@@ -187,13 +190,16 @@ public class UserAccessCsvExportService
                 var locations = string.Join("; ", entry.Locations.Select(l => l.SiteTitle));
                 sb.AppendLine(string.Join(",", new[]
                 {
-                    $"\"{entry.UserDisplayName}\"",
-                    $"\"{entry.UserLogin}\"",
-                    $"\"{entry.PermissionLevel}\"",
-                    $"\"{entry.AccessType}\"",
-                    $"\"{entry.GrantedThrough}\"",
-                    $"\"{locations}\"",
-                    $"\"{entry.LocationCount}\""
+                    Csv(entry.UserDisplayName),
+                    Csv(entry.UserLogin),
+                    Csv(entry.PermissionLevel),
+                    Csv(entry.AccessType.ToString()),
+                    Csv(entry.GrantedThrough),
+                    Csv(entry.TargetLabel ?? string.Empty),
+                    Csv(entry.TargetUrl ?? string.Empty),
+                    Csv(entry.SharingLinkType ?? string.Empty),
+                    Csv(locations),
+                    Csv(entry.LocationCount.ToString())
                 }));
             }
 
@@ -226,7 +232,10 @@ public class UserAccessCsvExportService
                 Csv(entry.ObjectUrl),
                 Csv(entry.PermissionLevel),
                 Csv(entry.AccessType.ToString()),
-                Csv(entry.GrantedThrough)
+                Csv(entry.GrantedThrough),
+                Csv(entry.TargetLabel ?? string.Empty),
+                Csv(entry.TargetUrl ?? string.Empty),
+                Csv(entry.SharingLinkType ?? string.Empty)
             }));
         }
 

SharepointToolbox/Services/Export/UserAccessHtmlExportService.cs

@@ -250,7 +250,7 @@ a:hover { text-decoration: underline; }
                 sb.AppendLine($"  <td>{objectCell}</td>");
                 sb.AppendLine($"  <td{rowClass}>{HtmlEncode(entry.PermissionLevel)}{highIcon}</td>");
                 sb.AppendLine($"  <td>{accessBadge}</td>");
-                sb.AppendLine($"  <td>{HtmlEncode(entry.GrantedThrough)}</td>");
+                sb.AppendLine($"  <td>{PermissionHtmlFragments.BuildGrantedThroughCell(entry.GrantedThrough, entry.TargetUrl, entry.TargetLabel, entry.SharingLinkType)}</td>");
                 sb.AppendLine("</tr>");
             }
         }
@@ -301,7 +301,7 @@ a:hover { text-decoration: underline; }
                 sb.AppendLine($"  <td>{objectCell}</td>");
                 sb.AppendLine($"  <td{rowClass}>{HtmlEncode(entry.PermissionLevel)}{highIcon}</td>");
                 sb.AppendLine($"  <td>{accessBadge}</td>");
-                sb.AppendLine($"  <td>{HtmlEncode(entry.GrantedThrough)}</td>");
+                sb.AppendLine($"  <td>{PermissionHtmlFragments.BuildGrantedThroughCell(entry.GrantedThrough, entry.TargetUrl, entry.TargetLabel, entry.SharingLinkType)}</td>");
                 sb.AppendLine("</tr>");
             }
         }
@@ -579,7 +579,7 @@ a:hover { text-decoration: underline; }
                 sb.AppendLine($"  <td{rowClass}>{HtmlEncode(entry.UserDisplayName)}{guestBadge}</td>");
                 sb.AppendLine($"  <td{rowClass}>{HtmlEncode(entry.PermissionLevel)}{highIcon}</td>");
                 sb.AppendLine($"  <td>{accessBadge}</td>");
-                sb.AppendLine($"  <td>{HtmlEncode(entry.GrantedThrough)}</td>");
+                sb.AppendLine($"  <td>{PermissionHtmlFragments.BuildGrantedThroughCell(entry.GrantedThrough, entry.TargetUrl, entry.TargetLabel, entry.SharingLinkType)}</td>");
 
                 if (entry.LocationCount == 1)
                 {

SharepointToolbox/Services/FileTransferService.cs

@@ -7,14 +7,19 @@ using SharepointToolbox.Core.Models;
 namespace SharepointToolbox.Services;
 
 /// <summary>
-/// Orchestrates server-side file copy/move between two SharePoint libraries
-/// (same or different tenants). Uses <see cref="MoveCopyUtil"/> for the
-/// transfer itself so bytes never round-trip through the local machine.
-/// Folder creation and enumeration are done via CSOM; all ambient retries
-/// flow through <see cref="ExecuteQueryRetryHelper"/>.
+/// Orchestrates file copy/move between two SharePoint libraries (same or
+/// different tenants). Hybrid strategy: server-side <see cref="MoveCopyUtil"/>
+/// first (zero local bandwidth), then transparent fallback to stream copy
+/// (<c>OpenBinaryDirect</c>/<c>SaveBinaryDirect</c>) on a list-view-threshold
+/// failure so transfers still succeed against libraries above the 5,000-item
+/// cap. Folder enumeration uses paged CAML; folder creation is cached per job
+/// to avoid re-checking the same path for every file.
 /// </summary>
 public class FileTransferService : IFileTransferService
 {
+    private const int ListViewThresholdItemCount = 5000;
+    private const int LargeLibraryPageSize = 500;
+
     /// <summary>
     /// Runs the configured <see cref="TransferJob"/>. Enumerates source files
     /// (unless the job is folder-only), pre-creates destination folders, then
@@ -30,12 +35,30 @@ public class FileTransferService : IFileTransferService
         IProgress<OperationProgress> progress,
         CancellationToken ct)
     {
-        // 1. Enumerate files from source (unless contents are suppressed).
+        // 1. Pre-flight: discover library item counts so we can pick a page size
+        // for source enumeration and warn early that the server-side copy path
+        // may trip the list-view threshold. The stream fallback in
+        // TransferSingleFileAsync handles the LVT case transparently, but the
+        // counts help size-tune enumeration up front.
+        var srcItemCount = await TryGetListItemCountAsync(sourceCtx, job.SourceLibrary, progress, ct);
+        var dstItemCount = await TryGetListItemCountAsync(destCtx, job.DestinationLibrary, progress, ct);
+        Log.Information(
+            "Transfer pre-flight: source={SrcLib} ({SrcCount} items), dest={DstLib} ({DstCount} items)",
+            job.SourceLibrary, srcItemCount, job.DestinationLibrary, dstItemCount);
+
+        if (srcItemCount > ListViewThresholdItemCount || dstItemCount > ListViewThresholdItemCount)
+        {
+            progress.Report(OperationProgress.Indeterminate(
+                $"Large library detected (source: {srcItemCount}, dest: {dstItemCount}). " +
+                "Using paged enumeration and stream-copy fallback when needed."));
+        }
+
+        // 2. Enumerate files from source (unless contents are suppressed).
         IReadOnlyList<string> files;
         if (job.CopyFolderContents)
         {
             progress.Report(new OperationProgress(0, 0, "Enumerating source files..."));
-            files = await EnumerateFilesAsync(sourceCtx, job, progress, ct);
+            files = await EnumerateFilesAsync(sourceCtx, job, srcItemCount, progress, ct);
         }
         else
         {
@@ -51,7 +74,7 @@ public class FileTransferService : IFileTransferService
             return new BulkOperationSummary<string>(new List<BulkItemResult<string>>());
         }
 
-        // 2. Build source and destination base paths. Resolve library roots via
+        // 3. Build source and destination base paths. Resolve library roots via
         // CSOM — constructing from title breaks for localized libraries whose
         // URL segment differs (e.g. title "Documents" → URL "Shared Documents"),
         // causing "Access denied" when CSOM tries to touch a non-existent path.
@@ -60,6 +83,11 @@ public class FileTransferService : IFileTransferService
         var dstBasePath = await ResolveLibraryPathAsync(
             destCtx, job.DestinationLibrary, job.DestinationFolderPath, progress, ct);
 
+        // Per-job cache of destination folders we've already ensured. Without
+        // this, EnsureFolderAsync re-checks .Exists for every file in the same
+        // folder — thousands of round-trips on a flat directory transfer.
+        var ensuredFolders = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
         // When IncludeSourceFolder is set, recreate the source folder name under
         // destination so dest/srcFolderName/... mirrors the source tree. When
         // no SourceFolderPath is set, fall back to the source library name.
@@ -74,11 +102,11 @@ public class FileTransferService : IFileTransferService
             if (!string.IsNullOrEmpty(srcFolderName))
             {
                 dstBasePath = $"{dstBasePath}/{srcFolderName}";
-                await EnsureFolderAsync(destCtx, dstBasePath, progress, ct);
+                await EnsureFolderCachedAsync(destCtx, dstBasePath, ensuredFolders, progress, ct);
             }
         }
 
-        // 3. Transfer each file using BulkOperationRunner
+        // 4. Transfer each file using BulkOperationRunner
         return await BulkOperationRunner.RunAsync(
             files,
             async (fileRelUrl, idx, token) =>
@@ -88,13 +116,13 @@ public class FileTransferService : IFileTransferService
                 if (fileRelUrl.StartsWith(srcBasePath, StringComparison.OrdinalIgnoreCase))
                     relativePart = fileRelUrl.Substring(srcBasePath.Length).TrimStart('/');
 
-                // Ensure destination folder exists
+                // Ensure destination folder exists (cached)
                 var destFolderRelative = dstBasePath;
                 var fileFolder = Path.GetDirectoryName(relativePart)?.Replace('\\', '/');
                 if (!string.IsNullOrEmpty(fileFolder))
                 {
                     destFolderRelative = $"{dstBasePath}/{fileFolder}";
-                    await EnsureFolderAsync(destCtx, destFolderRelative, progress, token);
+                    await EnsureFolderCachedAsync(destCtx, destFolderRelative, ensuredFolders, progress, token);
                 }
 
                 var fileName = Path.GetFileName(relativePart);
@@ -116,6 +144,32 @@ public class FileTransferService : IFileTransferService
         TransferJob job,
         IProgress<OperationProgress> progress,
         CancellationToken ct)
+    {
+        // Hybrid path: try the server-side MoveCopyUtil first (bytes never
+        // leave SharePoint). If the destination (or source) library trips the
+        // list-view threshold, fall back to a stream copy via HTTP-direct APIs
+        // that bypass list internals.
+        try
+        {
+            await ServerSideTransferAsync(sourceCtx, destCtx, srcFileUrl, dstFileUrl, job, progress, ct);
+        }
+        catch (ServerException ex) when (IsListViewThresholdException(ex))
+        {
+            Log.Warning(
+                "Server-side transfer hit list-view threshold for {File} — falling back to stream copy.",
+                srcFileUrl);
+            await StreamTransferAsync(sourceCtx, destCtx, srcFileUrl, dstFileUrl, job, progress, ct);
+        }
+    }
+
+    private async Task ServerSideTransferAsync(
+        ClientContext sourceCtx,
+        ClientContext destCtx,
+        string srcFileUrl,
+        string dstFileUrl,
+        TransferJob job,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct)
     {
         // MoveCopyUtil.CopyFileByPath expects absolute URLs (scheme + host),
         // not server-relative paths. Passing "/sites/..." silently fails or
@@ -153,9 +207,154 @@ public class FileTransferService : IFileTransferService
         }
     }
 
+    /// <summary>
+    /// Path-based stream copy fallback. Reads the source via
+    /// <see cref="Microsoft.SharePoint.Client.File.OpenBinaryStream"/> and writes
+    /// to the destination via <c>Folder.Files.Add(FileCreationInformation)</c>.
+    /// Both target a specific folder by path rather than querying list items,
+    /// so they succeed against libraries that exceed the list-view threshold.
+    /// Bytes do round-trip through the local machine — this is strictly the
+    /// fallback when server-side copy is unavailable.
+    /// </summary>
+    private async Task StreamTransferAsync(
+        ClientContext sourceCtx,
+        ClientContext destCtx,
+        string srcFileUrl,
+        string dstFileUrl,
+        TransferJob job,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct)
+    {
+        // Resolve the destination file name for conflict handling. Returns null
+        // when policy=Skip and the file already exists.
+        var effectiveDestUrl = await ResolveDestinationOnConflictAsync(destCtx, dstFileUrl, job, progress, ct);
+        if (effectiveDestUrl == null)
+        {
+            Log.Warning("Skipped (already exists, stream fallback): {File}", srcFileUrl);
+            return;
+        }
+
+        // Rename policy guarantees a free path via ResolveDestinationOnConflictAsync,
+        // so overwrite is only needed for the explicit Overwrite policy.
+        bool overwrite = job.ConflictPolicy == ConflictPolicy.Overwrite;
+
+        ct.ThrowIfCancellationRequested();
+
+        // 1. Download the source bytes into memory. OpenBinaryStream is a
+        // ClientResult<Stream> — usable only after ExecuteQuery.
+        var srcFile = sourceCtx.Web.GetFileByServerRelativeUrl(srcFileUrl);
+        var streamResult = srcFile.OpenBinaryStream();
+        await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(sourceCtx, progress, ct);
+
+        using var buffer = new MemoryStream();
+        await streamResult.Value.CopyToAsync(buffer, 81920, ct);
+        buffer.Position = 0;
+
+        // 2. Upload to the destination folder. Files.Add with ContentStream
+        // streams the payload in one request and does not touch list-view
+        // metadata, so it bypasses LVT.
+        var slash = effectiveDestUrl.LastIndexOf('/');
+        var destFolderUrl = effectiveDestUrl.Substring(0, slash);
+        var destFileName = effectiveDestUrl.Substring(slash + 1);
+
+        var destFolder = destCtx.Web.GetFolderByServerRelativeUrl(destFolderUrl);
+        var creation = new FileCreationInformation
+        {
+            Url = destFileName,
+            Overwrite = overwrite,
+            ContentStream = buffer,
+        };
+        destFolder.Files.Add(creation);
+        await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(destCtx, progress, ct);
+
+        if (job.Mode == TransferMode.Move)
+        {
+            // Stream copy cannot atomically move; delete the source after a
+            // successful upload to honour Move semantics.
+            var srcDelete = sourceCtx.Web.GetFileByServerRelativeUrl(srcFileUrl);
+            srcDelete.DeleteObject();
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(sourceCtx, progress, ct);
+        }
+    }
+
+    /// <summary>
+    /// Honours <see cref="TransferJob.ConflictPolicy"/> when the destination
+    /// path already exists. Returns the URL to write to, or <c>null</c> when
+    /// the file should be skipped. For <see cref="ConflictPolicy.Rename"/>,
+    /// probes <c>name (1).ext</c>, <c>name (2).ext</c>, ... until a free slot
+    /// is found.
+    /// </summary>
+    private static async Task<string?> ResolveDestinationOnConflictAsync(
+        ClientContext destCtx,
+        string dstFileUrl,
+        TransferJob job,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct)
+    {
+        if (job.ConflictPolicy == ConflictPolicy.Overwrite)
+            return dstFileUrl;
+
+        bool exists = await FileExistsAsync(destCtx, dstFileUrl, progress, ct);
+        if (!exists) return dstFileUrl;
+
+        if (job.ConflictPolicy == ConflictPolicy.Skip)
+            return null;
+
+        // Rename: keep both. Append " (n)" before the extension.
+        var dir = dstFileUrl.Substring(0, dstFileUrl.LastIndexOf('/'));
+        var leaf = dstFileUrl.Substring(dstFileUrl.LastIndexOf('/') + 1);
+        var stem = Path.GetFileNameWithoutExtension(leaf);
+        var ext = Path.GetExtension(leaf);
+
+        for (int n = 1; n <= 999; n++)
+        {
+            var candidate = $"{dir}/{stem} ({n}){ext}";
+            if (!await FileExistsAsync(destCtx, candidate, progress, ct))
+                return candidate;
+        }
+        // Extremely unlikely; surface as failure rather than silent overwrite.
+        throw new InvalidOperationException(
+            $"Could not find an unused destination filename for {dstFileUrl} after 999 attempts.");
+    }
+
+    private static async Task<bool> FileExistsAsync(
+        ClientContext ctx,
+        string fileServerRelativeUrl,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct)
+    {
+        try
+        {
+            var file = ctx.Web.GetFileByServerRelativeUrl(fileServerRelativeUrl);
+            ctx.Load(file, f => f.Exists);
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+            return file.Exists;
+        }
+        catch
+        {
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// Detects SharePoint's list-view-threshold ServerException across locales.
+    /// English: "exceeds the list view threshold". French: "depasse le seuil
+    /// d'affichage de liste". German: "Listenansichtsschwellenwert".
+    /// </summary>
+    internal static bool IsListViewThresholdException(Exception ex)
+    {
+        var msg = ex.Message ?? string.Empty;
+        return msg.Contains("list view threshold", StringComparison.OrdinalIgnoreCase)
+            || msg.Contains("seuil d'affichage", StringComparison.OrdinalIgnoreCase)
+            || msg.Contains("seuil d", StringComparison.OrdinalIgnoreCase) && msg.Contains("liste", StringComparison.OrdinalIgnoreCase)
+            || msg.Contains("Listenansichtsschwellenwert", StringComparison.OrdinalIgnoreCase)
+            || msg.Contains("umbral de vista de lista", StringComparison.OrdinalIgnoreCase);
+    }
+
     private async Task<IReadOnlyList<string>> EnumerateFilesAsync(
         ClientContext ctx,
         TransferJob job,
+        int sourceItemCount,
         IProgress<OperationProgress> progress,
         CancellationToken ct)
     {
@@ -226,6 +425,44 @@ public class FileTransferService : IFileTransferService
         return false;
     }
 
+    private async Task<int> TryGetListItemCountAsync(
+        ClientContext ctx,
+        string libraryTitle,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct)
+    {
+        try
+        {
+            var list = ctx.Web.Lists.GetByTitle(libraryTitle);
+            ctx.Load(list, l => l.ItemCount);
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+            return list.ItemCount;
+        }
+        catch (Exception ex)
+        {
+            // Non-fatal: pre-flight count is purely informational. Treat as
+            // unknown (-1) so the rest of the pipeline still runs.
+            Log.Warning("Failed to read ItemCount for {Library}: {Error}", libraryTitle, ex.Message);
+            return -1;
+        }
+    }
+
+    /// <summary>
+    /// EnsureFolderAsync wrapper that records successful checks in a per-job
+    /// set so the same destination folder isn't re-validated for every file.
+    /// </summary>
+    private async Task EnsureFolderCachedAsync(
+        ClientContext ctx,
+        string folderServerRelativeUrl,
+        HashSet<string> cache,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct)
+    {
+        var normalized = folderServerRelativeUrl.TrimEnd('/');
+        if (!cache.Add(normalized)) return;
+        await EnsureFolderAsync(ctx, normalized, progress, ct);
+    }
+
     private async Task EnsureFolderAsync(
         ClientContext ctx,
         string folderServerRelativeUrl,

SharepointToolbox/Services/ISystemGroupTargetResolver.cs

@@ -0,0 +1,23 @@
+using Microsoft.SharePoint.Client;
+using SharepointToolbox.Core.Helpers;
+using SharepointToolbox.Core.Models;
+
+namespace SharepointToolbox.Services;
+
+/// <summary>
+/// Resolves the targeted resource (List, Web, File, Folder) for a SharePoint system
+/// group whose name encodes a GUID — Limited Access System Group For Web/List and
+/// SharingLinks.{itemId}.{type}.{shareId}. Returns null when the target is missing
+/// or unreachable (deleted item, access denied, etc.) — callers fall back to the
+/// raw group name.
+/// </summary>
+public interface ISystemGroupTargetResolver
+{
+    /// <summary>
+    /// Resolves the target for a classified system group. Cached per (ctx site, guid).
+    /// </summary>
+    Task<SystemGroupTarget?> ResolveAsync(
+        ClientContext ctx,
+        SystemGroupClassification classification,
+        CancellationToken ct);
+}

SharepointToolbox/Services/PermissionsService.cs

@@ -11,6 +11,16 @@ namespace SharepointToolbox.Services;
 /// </summary>
 public class PermissionsService : IPermissionsService
 {
+    private readonly ISystemGroupTargetResolver? _systemGroupResolver;
+
+    public PermissionsService() : this(null) { }
+
+    public PermissionsService(ISystemGroupTargetResolver? systemGroupResolver)
+    {
+        _systemGroupResolver = systemGroupResolver;
+    }
+
+
     /// <summary>
     /// Detects the SharePoint server error raised when a RoleAssignment member
     /// refers to a user that no longer resolves (orphaned Azure AD account).
@@ -336,9 +346,18 @@ public class PermissionsService : IPermissionsService
 
             var member = ra.Member;
             var loginName = member.LoginName ?? string.Empty;
+            var memberTitle = member.Title ?? string.Empty;
 
-            // Skip sharing links groups and limited access system groups
-            if (PermissionEntryHelper.IsSharingLinksGroup(loginName))
+            // Classify the member name. The bare "Limited Access System Group" is
+            // pure noise; drop it. The For-Web/For-List and SharingLinks variants
+            // are kept and enriched below with a resolved target URL.
+            var classification = PermissionEntryHelper.Classify(memberTitle);
+            if (classification.Kind == SystemGroupKind.None
+                && PermissionEntryHelper.IsBareLimitedAccessSystemGroup(loginName))
+            {
+                continue;
+            }
+            if (classification.Kind == SystemGroupKind.LimitedAccessBare)
                 continue;
 
             // Collect and filter permission levels
@@ -362,19 +381,42 @@ public class PermissionsService : IPermissionsService
 
             // Determine how the permission was granted
             string grantedThrough = principalType == "SharePointGroup"
-                ? $"SharePoint Group: {member.Title}"
+                ? $"SharePoint Group: {memberTitle}"
                 : "Direct Permissions";
 
+            // Resolve system-group target (Limited Access For Web/List, SharingLinks)
+            string? targetUrl = null;
+            string? targetLabel = null;
+            string? sharingLinkType = null;
+            if (_systemGroupResolver is not null && classification.Kind != SystemGroupKind.None)
+            {
+                var target = await _systemGroupResolver.ResolveAsync(ctx, classification, ct);
+                if (target is not null)
+                {
+                    targetUrl = target.Url;
+                    targetLabel = target.Label;
+                    sharingLinkType = target.LinkType;
+                }
+                else if (classification.Kind == SystemGroupKind.SharingLink)
+                {
+                    // Target lookup failed (deleted item / no access) — still surface link type.
+                    sharingLinkType = classification.LinkType;
+                }
+            }
+
             entries.Add(new PermissionEntry(
                 ObjectType: objectType,
                 Title: title,
                 Url: url,
                 HasUniquePermissions: obj.HasUniqueRoleAssignments,
-                Users: member.Title ?? string.Empty,
+                Users: memberTitle,
                 UserLogins: loginName,
                 PermissionLevels: permLevels,
                 GrantedThrough: grantedThrough,
-                PrincipalType: principalType));
+                PrincipalType: principalType,
+                TargetUrl: targetUrl,
+                TargetLabel: targetLabel,
+                SharingLinkType: sharingLinkType));
         }
 
         return entries;

SharepointToolbox/Services/SharePointGroupResolver.cs

@@ -23,7 +23,7 @@ namespace SharepointToolbox.Services;
 /// </summary>
 public class SharePointGroupResolver : ISharePointGroupResolver
 {
-    private readonly AppGraphClientFactory? _graphClientFactory;
+    private readonly AppGraphClientFactory _graphClientFactory;
 
     public SharePointGroupResolver(AppGraphClientFactory graphClientFactory)
     {
@@ -57,6 +57,7 @@ public class SharePointGroupResolver : ISharePointGroupResolver
             foreach (var g in ctx.Web.SiteGroups)
                 groupTitles.Add(g.Title);
         }
+        catch (OperationCanceledException) { throw; }
         catch (Exception ex)
         {
             Log.Warning("Could not enumerate SiteGroups on {Url}: {Error}", ctx.Url, ex.Message);
@@ -92,7 +93,7 @@ public class SharePointGroupResolver : ISharePointGroupResolver
                     if (IsAadGroup(user.LoginName))
                     {
                         // Lazy-create graph client on first AAD group encountered
-                        graphClient ??= await _graphClientFactory!.CreateClientAsync(clientId, ct);
+                        graphClient ??= await _graphClientFactory.CreateClientAsync(clientId, ct);
 
                         var aadId = ExtractAadGroupId(user.LoginName);
                         var leafUsers = await ResolveAadGroupAsync(graphClient, aadId, ct);
@@ -110,6 +111,7 @@ public class SharePointGroupResolver : ISharePointGroupResolver
                     .DistinctBy(m => m.Login, StringComparer.OrdinalIgnoreCase)
                     .ToList();
             }
+            catch (OperationCanceledException) { throw; }
             catch (Exception ex)
             {
                 Log.Warning("Could not resolve SP group '{Group}': {Error}", groupName, ex.Message);
@@ -182,6 +184,7 @@ public class SharePointGroupResolver : ISharePointGroupResolver
             await pageIterator.IterateAsync(ct);
             return members;
         }
+        catch (OperationCanceledException) { throw; }
         catch (Exception ex)
         {
             Log.Warning("Could not resolve AAD group '{Id}' transitively: {Error}", aadGroupId, ex.Message);

SharepointToolbox/Services/SystemGroupTargetResolver.cs

@@ -0,0 +1,207 @@
+using Microsoft.SharePoint.Client;
+using Microsoft.SharePoint.Client.Search.Query;
+using Serilog;
+using SharepointToolbox.Core.Helpers;
+using SharepointToolbox.Core.Models;
+
+namespace SharepointToolbox.Services;
+
+/// <summary>
+/// CSOM-backed resolver that converts the GUID/identifier embedded in a SharePoint
+/// system group name into a clickable target. Results are cached per
+/// (site URL, guid) to avoid repeated round-trips when the same Limited Access
+/// system group recurs on many objects.
+///
+/// Never throws — on any failure (not found, access denied, claims error), returns
+/// <c>null</c> and the caller renders the raw group name.
+/// </summary>
+public class SystemGroupTargetResolver : ISystemGroupTargetResolver
+{
+    private readonly Dictionary<string, SystemGroupTarget?> _cache =
+        new(StringComparer.OrdinalIgnoreCase);
+
+    public async Task<SystemGroupTarget?> ResolveAsync(
+        ClientContext ctx,
+        SystemGroupClassification classification,
+        CancellationToken ct)
+    {
+        ct.ThrowIfCancellationRequested();
+
+        var key = BuildCacheKey(ctx.Url, classification);
+        if (key is not null && _cache.TryGetValue(key, out var cached))
+            return cached;
+
+        SystemGroupTarget? result = null;
+        try
+        {
+            result = classification.Kind switch
+            {
+                SystemGroupKind.LimitedAccessWeb  => await ResolveWebAsync(ctx, classification.WebId!.Value, ct),
+                SystemGroupKind.LimitedAccessList => await ResolveListAsync(ctx, classification.ListId!.Value, ct),
+                SystemGroupKind.SharingLink       => await ResolveItemAsync(ctx, classification.ItemUniqueId!.Value, classification.LinkType, ct),
+                _ => null
+            };
+        }
+        catch (OperationCanceledException) { throw; }
+        catch (Exception ex)
+        {
+            Log.Debug("System group target resolution failed for {Kind} on {Site}: {Error}",
+                classification.Kind, ctx.Url, ex.Message);
+        }
+
+        if (key is not null)
+            _cache[key] = result;
+        return result;
+    }
+
+    private static string? BuildCacheKey(string siteUrl, SystemGroupClassification c) => c.Kind switch
+    {
+        SystemGroupKind.LimitedAccessWeb  => $"{siteUrl}|web|{c.WebId}",
+        SystemGroupKind.LimitedAccessList => $"{siteUrl}|list|{c.ListId}",
+        SystemGroupKind.SharingLink       => $"{siteUrl}|item|{c.ItemUniqueId}",
+        _ => null
+    };
+
+    private static async Task<SystemGroupTarget?> ResolveWebAsync(
+        ClientContext ctx, Guid webId, CancellationToken ct)
+    {
+        var web = ctx.Site.OpenWebById(webId);
+        ctx.Load(web, w => w.Title, w => w.Url);
+        await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, null, ct);
+        return new SystemGroupTarget(SystemGroupKind.LimitedAccessWeb, web.Title, web.Url);
+    }
+
+    private static async Task<SystemGroupTarget?> ResolveListAsync(
+        ClientContext ctx, Guid listId, CancellationToken ct)
+    {
+        var list = ctx.Web.Lists.GetById(listId);
+        ctx.Load(list, l => l.Title, l => l.DefaultViewUrl);
+        await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, null, ct);
+
+        var url = BuildAbsoluteUrl(ctx.Url, list.DefaultViewUrl);
+        return new SystemGroupTarget(SystemGroupKind.LimitedAccessList, list.Title, url);
+    }
+
+    private static async Task<SystemGroupTarget?> ResolveItemAsync(
+        ClientContext ctx, Guid itemUniqueId, string? linkType, CancellationToken ct)
+    {
+        // 1. Try as file on current web (most sharing links target files).
+        try
+        {
+            var file = ctx.Web.GetFileById(itemUniqueId);
+            ctx.Load(file, f => f.Name, f => f.ServerRelativeUrl, f => f.Exists);
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, null, ct);
+
+            if (file.Exists)
+            {
+                var url = BuildAbsoluteUrl(ctx.Url, file.ServerRelativeUrl);
+                return new SystemGroupTarget(SystemGroupKind.SharingLink, file.Name, url, linkType);
+            }
+        }
+        catch (ServerException ex) { Log.Debug("File by ID not found for {Id} on {Site}: {Error}", itemUniqueId, ctx.Url, ex.Message); }
+
+        // 2. Try as folder on current web.
+        try
+        {
+            var folder = ctx.Web.GetFolderById(itemUniqueId);
+            ctx.Load(folder, f => f.Name, f => f.ServerRelativeUrl);
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, null, ct);
+
+            var url = BuildAbsoluteUrl(ctx.Url, folder.ServerRelativeUrl);
+            return new SystemGroupTarget(SystemGroupKind.SharingLink, folder.Name, url, linkType);
+        }
+        catch (ServerException ex) { Log.Debug("Folder by ID not found for {Id} on {Site}: {Error}", itemUniqueId, ctx.Url, ex.Message); }
+
+        // 3. Search-index fallback — covers items moved to a different subsite or
+        //    deleted recently (the index may lag the deletion by minutes/hours).
+        //    Search is permission-trimmed, so this only returns hits the caller
+        //    can still see; results carry a "(via index)" hint in the label.
+        return await TryResolveViaSearchAsync(ctx, itemUniqueId, linkType, ct);
+    }
+
+    /// <summary>
+    /// Queries the SharePoint search index for an item by its UniqueId. Returns
+    /// a target with the last-indexed path and a label prefix flagging that the
+    /// hit came from the index (so admins know the live lookup failed).
+    /// </summary>
+    private static async Task<SystemGroupTarget?> TryResolveViaSearchAsync(
+        ClientContext ctx, Guid itemUniqueId, string? linkType, CancellationToken ct)
+    {
+        ct.ThrowIfCancellationRequested();
+        try
+        {
+            // KQL: UniqueId managed property. Braces around the GUID are how the
+            // SP search engine matches the canonical form for content unique ids.
+            var kq = new KeywordQuery(ctx)
+            {
+                QueryText      = $"UniqueId:{{{itemUniqueId}}}",
+                RowLimit       = 1,
+                TrimDuplicates = false
+            };
+            kq.SelectProperties.Add("Path");
+            kq.SelectProperties.Add("Title");
+            kq.SelectProperties.Add("FileExtension");
+
+            var executor = new SearchExecutor(ctx);
+            var result = executor.ExecuteQuery(kq);
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, null, ct);
+
+            var table = result.Value
+                .FirstOrDefault(t => t.TableType == KnownTableTypes.RelevantResults);
+            if (table is null || table.RowCount == 0)
+                return null;
+
+            var row = ToDict(table.ResultRows.First());
+            var path  = row.TryGetValue("Path",  out var p) ? p?.ToString() : null;
+            var title = row.TryGetValue("Title", out var t) ? t?.ToString() : null;
+
+            if (string.IsNullOrEmpty(path))
+                return null;
+
+            // Derive a leaf name if Title is empty (folders often have no Title).
+            var leaf = !string.IsNullOrWhiteSpace(title)
+                ? title!
+                : Uri.UnescapeDataString(path.TrimEnd('/').Split('/').Last());
+
+            return new SystemGroupTarget(
+                SystemGroupKind.SharingLink,
+                $"{leaf} (via index)",
+                path,
+                linkType);
+        }
+        catch (OperationCanceledException) { throw; }
+        catch (Exception ex)
+        {
+            Log.Debug("UniqueId search fallback failed for {Item} on {Site}: {Error}",
+                itemUniqueId, ctx.Url, ex.Message);
+            return null;
+        }
+    }
+
+    /// <summary>
+    /// CSOM SearchExecutor returns ResultRows as either generic Dictionary or legacy
+    /// IDictionary depending on CSOM version — normalise to a single shape.
+    /// </summary>
+    private static IDictionary<string, object> ToDict(object rawRow)
+    {
+        if (rawRow is IDictionary<string, object> generic)
+            return generic;
+        var dict = new Dictionary<string, object>();
+        if (rawRow is System.Collections.IDictionary legacy)
+        {
+            foreach (System.Collections.DictionaryEntry e in legacy)
+                dict[e.Key.ToString()!] = e.Value ?? string.Empty;
+        }
+        return dict;
+    }
+
+    private static string BuildAbsoluteUrl(string contextUrl, string? serverRelative)
+    {
+        if (string.IsNullOrEmpty(serverRelative))
+            return contextUrl;
+        if (Uri.TryCreate(serverRelative, UriKind.Absolute, out _))
+            return serverRelative;
+        var uri = new Uri(contextUrl);
+        return $"{uri.Scheme}://{uri.Host}{serverRelative}";
+    }
+}

SharepointToolbox/Services/UserAccessAuditService.cs

@@ -136,7 +136,10 @@ public class UserAccessAuditService : IUserAccessAuditService
                         AccessType: accessType,
                         GrantedThrough: entry.GrantedThrough,
                         IsHighPrivilege: HighPrivilegeLevels.Contains(trimmedLevel),
-                        IsExternalUser: PermissionEntryHelper.IsExternalUser(login));
+                        IsExternalUser: PermissionEntryHelper.IsExternalUser(login),
+                        TargetUrl: entry.TargetUrl,
+                        TargetLabel: entry.TargetLabel,
+                        SharingLinkType: entry.SharingLinkType);
                 }
             }
         }

SharepointToolbox/Services/VersionCleanupService.cs

@@ -117,6 +117,7 @@ public class VersionCleanupService : IVersionCleanupService
         IProgress<OperationProgress> progress,
         CancellationToken ct)
     {
+        int before = 0;
         try
         {
             var file = ctx.Web.GetFileByServerRelativeUrl(fileServerRelativeUrl);
@@ -131,7 +132,7 @@ public class VersionCleanupService : IVersionCleanupService
             // file.Versions contains only HISTORICAL versions; the current published
             // version lives on `file` itself and is never deletable here.
             var versions = file.Versions.ToList();
-            int before = versions.Count;
+            before = versions.Count;
             if (before == 0) return null;
 
             // Sort by Created ascending so [0] is the oldest historical version.
@@ -173,6 +174,7 @@ public class VersionCleanupService : IVersionCleanupService
                 BytesFreed = bytesFreed,
             };
         }
+        catch (OperationCanceledException) { throw; }
         catch (Exception ex)
         {
             _logger.LogWarning(ex, "Failed to trim versions for {File}", fileServerRelativeUrl);
@@ -182,6 +184,7 @@ public class VersionCleanupService : IVersionCleanupService
                 Library = libraryTitle,
                 FileServerRelativeUrl = fileServerRelativeUrl,
                 FileName = System.IO.Path.GetFileName(fileServerRelativeUrl),
+                VersionsBefore = before,
                 Error = ex.Message,
             };
         }

SharepointToolbox/SharepointToolbox.csproj

@@ -54,6 +54,14 @@
     <PackageReference Include="LiveChartsCore.SkiaSharpView.WPF" Version="2.0.0-rc5.4" />
     <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.0" />
     <PackageReference Include="Microsoft.Graph" Version="5.74.0" />
+    <!-- Override Kiota transitive deps to patch GHSA-7j59-v9qr-6fq9 (NU1903 in <1.20.0) -->
+    <PackageReference Include="Microsoft.Kiota.Abstractions" Version="1.22.2" />
+    <PackageReference Include="Microsoft.Kiota.Authentication.Azure" Version="1.22.2" />
+    <PackageReference Include="Microsoft.Kiota.Http.HttpClientLibrary" Version="1.22.2" />
+    <PackageReference Include="Microsoft.Kiota.Serialization.Form" Version="1.22.2" />
+    <PackageReference Include="Microsoft.Kiota.Serialization.Json" Version="1.22.2" />
+    <PackageReference Include="Microsoft.Kiota.Serialization.Multipart" Version="1.22.2" />
+    <PackageReference Include="Microsoft.Kiota.Serialization.Text" Version="1.22.2" />
     <PackageReference Include="Microsoft.Identity.Client" Version="4.83.3" />
     <PackageReference Include="Microsoft.Identity.Client.Broker" Version="4.82.1" />
     <PackageReference Include="Microsoft.Identity.Client.Extensions.Msal" Version="4.83.3" />

SharepointToolbox/Themes/DarkPalette.xaml

@@ -17,6 +17,8 @@
   <SolidColorBrush x:Key="AccentForegroundBrush" Color="#0B1220" />
   <SolidColorBrush x:Key="DangerBrush"        Color="#F87171" />
   <SolidColorBrush x:Key="SuccessBrush"       Color="#34D399" />
+  <SolidColorBrush x:Key="ErrorRowBgBrush"    Color="#2D0C0C" />
+  <SolidColorBrush x:Key="ErrorRowFgBrush"    Color="#F87171" />
   <!-- Forced-dark text for elements painted with hardcoded light pastel backgrounds (risk tiles, colored rows). -->
   <SolidColorBrush x:Key="OnColoredBgBrush"   Color="#1F2430" />
   <SolidColorBrush x:Key="SelectionBrush"     Color="#2A4572" />

SharepointToolbox/Themes/LightPalette.xaml

@@ -17,6 +17,8 @@
   <SolidColorBrush x:Key="AccentForegroundBrush" Color="#FFFFFF" />
   <SolidColorBrush x:Key="DangerBrush"        Color="#DC2626" />
   <SolidColorBrush x:Key="SuccessBrush"       Color="#047857" />
+  <SolidColorBrush x:Key="ErrorRowBgBrush"    Color="#FDE0E0" />
+  <SolidColorBrush x:Key="ErrorRowFgBrush"    Color="#B00020" />
   <SolidColorBrush x:Key="OnColoredBgBrush"   Color="#1F2430" />
   <SolidColorBrush x:Key="SelectionBrush"     Color="#DBE7FF" />
   <SolidColorBrush x:Key="ScrollThumbBrush"   Color="#B8BEC7" />

SharepointToolbox/Themes/ModernTheme.xaml

@@ -1357,6 +1357,55 @@
     <Setter Property="Height" Value="6" />
   </Style>
 
+  <!-- ====================================================== -->
+  <!--  InfoButton — small circular "?" help button            -->
+  <!-- ====================================================== -->
+  <Style x:Key="InfoButtonStyle" TargetType="{x:Type Button}">
+    <Setter Property="Width" Value="18" />
+    <Setter Property="Height" Value="18" />
+    <Setter Property="Cursor" Value="Hand" />
+    <Setter Property="Background" Value="Transparent" />
+    <Setter Property="BorderBrush" Value="{DynamicResource TextMutedBrush}" />
+    <Setter Property="BorderThickness" Value="1.5" />
+    <Setter Property="Padding" Value="0" />
+    <Setter Property="FontSize" Value="11" />
+    <Setter Property="FontWeight" Value="SemiBold" />
+    <Setter Property="Foreground" Value="{DynamicResource TextMutedBrush}" />
+    <Setter Property="FocusVisualStyle" Value="{x:Null}" />
+    <Setter Property="SnapsToDevicePixels" Value="True" />
+    <Setter Property="Template">
+      <Setter.Value>
+        <ControlTemplate TargetType="{x:Type Button}">
+          <Grid>
+            <Ellipse x:Name="Circle"
+                     Fill="{TemplateBinding Background}"
+                     Stroke="{TemplateBinding BorderBrush}"
+                     StrokeThickness="{TemplateBinding BorderThickness}" />
+            <TextBlock x:Name="Label"
+                       Text="?"
+                       Foreground="{TemplateBinding Foreground}"
+                       FontSize="{TemplateBinding FontSize}"
+                       FontWeight="{TemplateBinding FontWeight}"
+                       HorizontalAlignment="Center"
+                       VerticalAlignment="Center"
+                       SnapsToDevicePixels="True" />
+          </Grid>
+          <ControlTemplate.Triggers>
+            <Trigger Property="IsMouseOver" Value="True">
+              <Setter TargetName="Circle" Property="Fill"   Value="{DynamicResource AccentSoftBrush}" />
+              <Setter TargetName="Circle" Property="Stroke" Value="{DynamicResource AccentBrush}" />
+              <Setter TargetName="Label"  Property="Foreground" Value="{DynamicResource AccentBrush}" />
+            </Trigger>
+            <Trigger Property="IsPressed" Value="True">
+              <Setter TargetName="Circle" Property="Fill" Value="{DynamicResource AccentBrush}" />
+              <Setter TargetName="Label"  Property="Foreground" Value="{DynamicResource AccentForegroundBrush}" />
+            </Trigger>
+          </ControlTemplate.Triggers>
+        </ControlTemplate>
+      </Setter.Value>
+    </Setter>
+  </Style>
+
   <!-- ====================================================== -->
   <!--  ToolTip                                                 -->
   <!-- ====================================================== -->

SharepointToolbox/ViewModels/Tabs/PermissionsViewModel.cs

@@ -45,6 +45,23 @@ public partial class PermissionsViewModel : FeatureViewModelBase
     [ObservableProperty]
     private bool _mergePermissions;
 
+    /// <summary>
+    /// When true, the HTML report hides the raw "SharePoint Group: SharingLinks.{guid}…"
+    /// / "Limited Access System Group For Web|List {guid}" text for rows where the
+    /// system-group target was resolved — only the link-type badge and target link are shown.
+    /// Rows whose target could not be resolved still display the raw name as a fallback.
+    /// </summary>
+    [ObservableProperty]
+    private bool _hideSystemGroupRaw = true;
+
+    /// <summary>When true, sharing link entries (SharingLinkType != null) are removed from results and exports.</summary>
+    [ObservableProperty]
+    private bool _excludeSharingLinks;
+
+    /// <summary>When true, "Limited Access System Group For Web/List" entries are removed from results and exports.</summary>
+    [ObservableProperty]
+    private bool _excludeSystemGroups;
+
     [ObservableProperty]
     private bool _includeSubsites;
 
@@ -93,6 +110,17 @@ public partial class PermissionsViewModel : FeatureViewModelBase
     private ReportSplitMode CurrentSplit => SplitModeIndex == 1 ? ReportSplitMode.BySite : ReportSplitMode.Single;
     private HtmlSplitLayout CurrentLayout => HtmlLayoutIndex == 1 ? HtmlSplitLayout.SingleTabbed : HtmlSplitLayout.SeparateFiles;
 
+    /// <summary>
+    /// Results after applying ExcludeSharingLinks / ExcludeSystemGroups filters.
+    /// Rebuilt when Results changes or filter flags change.
+    /// </summary>
+    private IReadOnlyList<PermissionEntry> _filteredResults = Array.Empty<PermissionEntry>();
+    public IReadOnlyList<PermissionEntry> FilteredResults
+    {
+        get => _filteredResults;
+        private set => SetProperty(ref _filteredResults, value);
+    }
+
     /// <summary>
     /// Simplified wrappers computed from Results. Rebuilt when Results changes.
     /// </summary>
@@ -115,16 +143,37 @@ public partial class PermissionsViewModel : FeatureViewModelBase
 
     /// <summary>
     /// The collection the DataGrid actually binds to. Returns:
-    /// - Results (raw) when simplified mode is OFF
+    /// - FilteredResults (raw) when simplified mode is OFF
     /// - SimplifiedResults when simplified mode is ON and detail view is ON
     /// - (View handles summary display separately via Summaries property)
     /// </summary>
     public object ActiveItemsSource => IsSimplifiedMode
         ? (object)SimplifiedResults
-        : Results;
+        : FilteredResults;
 
     partial void OnFolderDepthChanged(int value) => OnPropertyChanged(nameof(IsMaxDepth));
 
+    partial void OnExcludeSharingLinksChanged(bool value) => RefreshAfterFilterChange();
+    partial void OnExcludeSystemGroupsChanged(bool value) => RefreshAfterFilterChange();
+
+    private void RefreshAfterFilterChange()
+    {
+        if (Results.Count == 0) return;
+        RebuildFilteredResults();
+        if (IsSimplifiedMode) RebuildSimplifiedData();
+        OnPropertyChanged(nameof(ActiveItemsSource));
+    }
+
+    private void RebuildFilteredResults()
+    {
+        IEnumerable<PermissionEntry> filtered = Results;
+        if (ExcludeSharingLinks)
+            filtered = filtered.Where(e => string.IsNullOrEmpty(e.SharingLinkType));
+        if (ExcludeSystemGroups)
+            filtered = filtered.Where(e => !e.GrantedThrough.Contains("Limited Access System Group", StringComparison.OrdinalIgnoreCase));
+        FilteredResults = filtered.ToList();
+    }
+
     // ── Commands ────────────────────────────────────────────────────────────
 
     public IAsyncRelayCommand ExportCsvCommand { get; }
@@ -163,8 +212,8 @@ public partial class PermissionsViewModel : FeatureViewModelBase
         _settingsService = settingsService;
         _ownershipService = ownershipService;
 
-        ExportCsvCommand = new AsyncRelayCommand(ExportCsvAsync, CanExport);
-        ExportHtmlCommand = new AsyncRelayCommand(ExportHtmlAsync, CanExport);
+        ExportCsvCommand = new AsyncRelayCommand(ct => ExportCsvAsync(ct), CanExport);
+        ExportHtmlCommand = new AsyncRelayCommand(ct => ExportHtmlAsync(ct), CanExport);
     }
 
     /// <summary>
@@ -190,8 +239,8 @@ public partial class PermissionsViewModel : FeatureViewModelBase
         _settingsService = settingsService;
         _ownershipService = ownershipService;
 
-        ExportCsvCommand = new AsyncRelayCommand(ExportCsvAsync, CanExport);
-        ExportHtmlCommand = new AsyncRelayCommand(ExportHtmlAsync, CanExport);
+        ExportCsvCommand = new AsyncRelayCommand(ct => ExportCsvAsync(ct), CanExport);
+        ExportHtmlCommand = new AsyncRelayCommand(ct => ExportHtmlAsync(ct), CanExport);
     }
 
     // ── FeatureViewModelBase implementation ─────────────────────────────────
@@ -212,9 +261,18 @@ public partial class PermissionsViewModel : FeatureViewModelBase
     /// Recomputes SimplifiedResults and Summaries from the current Results collection.
     /// Called when Results changes or when simplified mode is toggled on.
     /// </summary>
+    private static bool IsSimplifiedModeNoise(PermissionEntry e)
+    {
+        if (e.Users.Contains("SharePointHome", StringComparison.OrdinalIgnoreCase)) return true;
+        if (e.GrantedThrough.Contains("SharePointHome", StringComparison.OrdinalIgnoreCase)) return true;
+        if (e.UserLogins.Split(';').Any(l => l.Trim().StartsWith("c:0u.c|tenant|", StringComparison.OrdinalIgnoreCase))) return true;
+        return false;
+    }
+
     private void RebuildSimplifiedData()
     {
-        SimplifiedResults = SimplifiedPermissionEntry.WrapAll(Results);
+        var forSimplified = FilteredResults.Where(e => !IsSimplifiedModeNoise(e));
+        SimplifiedResults = SimplifiedPermissionEntry.WrapAll(forSimplified);
         Summaries = PermissionSummaryBuilder.Build(SimplifiedResults);
     }
 
@@ -294,6 +352,7 @@ public partial class PermissionsViewModel : FeatureViewModelBase
             await dispatcher.InvokeAsync(() =>
             {
                 Results = new ObservableCollection<PermissionEntry>(allEntries);
+                RebuildFilteredResults();
                 if (IsSimplifiedMode)
                     RebuildSimplifiedData();
                 OnPropertyChanged(nameof(ActiveItemsSource));
@@ -302,6 +361,7 @@ public partial class PermissionsViewModel : FeatureViewModelBase
         else
         {
             Results = new ObservableCollection<PermissionEntry>(allEntries);
+            RebuildFilteredResults();
             if (IsSimplifiedMode)
                 RebuildSimplifiedData();
             OnPropertyChanged(nameof(ActiveItemsSource));
@@ -375,6 +435,7 @@ public partial class PermissionsViewModel : FeatureViewModelBase
     {
         _currentProfile = profile;
         Results = new ObservableCollection<PermissionEntry>();
+        FilteredResults = Array.Empty<PermissionEntry>();
         SimplifiedResults = Array.Empty<SimplifiedPermissionEntry>();
         Summaries = Array.Empty<PermissionSummary>();
         OnPropertyChanged(nameof(ActiveItemsSource));
@@ -395,7 +456,7 @@ public partial class PermissionsViewModel : FeatureViewModelBase
 
     private bool CanExport() => Results.Count > 0;
 
-    private async Task ExportCsvAsync()
+    private async Task ExportCsvAsync(CancellationToken ct)
     {
         if (_csvExportService == null || Results.Count == 0) return;
         var dialog = new SaveFileDialog
@@ -409,9 +470,9 @@ public partial class PermissionsViewModel : FeatureViewModelBase
         try
         {
             if (IsSimplifiedMode && SimplifiedResults.Count > 0)
-                await _csvExportService.WriteAsync(SimplifiedResults.ToList(), dialog.FileName, CurrentSplit, CancellationToken.None);
+                await _csvExportService.WriteAsync(SimplifiedResults.ToList(), dialog.FileName, CurrentSplit, ct);
             else
-                await _csvExportService.WriteAsync((IReadOnlyList<PermissionEntry>)Results, dialog.FileName, CurrentSplit, CancellationToken.None);
+                await _csvExportService.WriteAsync(FilteredResults, dialog.FileName, CurrentSplit, ct);
             OpenFile(dialog.FileName);
         }
         catch (Exception ex)
@@ -421,7 +482,7 @@ public partial class PermissionsViewModel : FeatureViewModelBase
         }
     }
 
-    private async Task ExportHtmlAsync()
+    private async Task ExportHtmlAsync(CancellationToken ct)
     {
         if (_htmlExportService == null || Results.Count == 0) return;
         var dialog = new SaveFileDialog
@@ -449,7 +510,7 @@ public partial class PermissionsViewModel : FeatureViewModelBase
                 // by the site it was observed on, then resolve against that
                 // site's context. Using the root tenant ctx for a group that
                 // lives on a sub-site makes CSOM fail with "Group not found".
-                var groupsBySite = Results
+                var groupsBySite = FilteredResults
                     .Where(r => r.PrincipalType == "SharePointGroup")
                     .SelectMany(r => r.Users
                         .Split(';', StringSplitOptions.RemoveEmptyEntries)
@@ -479,9 +540,9 @@ public partial class PermissionsViewModel : FeatureViewModelBase
                                 Name = _currentProfile.Name
                             };
                             var ctx = await _sessionManager.GetOrCreateContextAsync(
-                                siteProfile, CancellationToken.None);
+                                siteProfile, ct);
                             var resolved = await _groupResolver.ResolveGroupsAsync(
-                                ctx, _currentProfile.ClientId, distinctNames, CancellationToken.None);
+                                ctx, _currentProfile.ClientId, distinctNames, ct);
                             foreach (var kv in resolved)
                                 merged[kv.Key] = kv.Value;
                         }
@@ -498,9 +559,9 @@ public partial class PermissionsViewModel : FeatureViewModelBase
             }
 
             if (IsSimplifiedMode && SimplifiedResults.Count > 0)
-                await _htmlExportService.WriteAsync(SimplifiedResults.ToList(), dialog.FileName, CurrentSplit, CurrentLayout, CancellationToken.None, branding, groupMembers);
+                await _htmlExportService.WriteAsync(SimplifiedResults.ToList(), dialog.FileName, CurrentSplit, CurrentLayout, ct, branding, groupMembers, HideSystemGroupRaw);
             else
-                await _htmlExportService.WriteAsync((IReadOnlyList<PermissionEntry>)Results, dialog.FileName, CurrentSplit, CurrentLayout, CancellationToken.None, branding, groupMembers);
+                await _htmlExportService.WriteAsync(FilteredResults, dialog.FileName, CurrentSplit, CurrentLayout, ct, branding, groupMembers, HideSystemGroupRaw);
             OpenFile(dialog.FileName);
         }
         catch (Exception ex)

SharepointToolbox/Views/Common/InfoButton.xaml

@@ -0,0 +1,39 @@
+<UserControl x:Class="SharepointToolbox.Views.Common.InfoButton"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             x:Name="Root"
+             Width="18" Height="18"
+             VerticalAlignment="Center">
+    <Grid>
+        <Button x:Name="Btn"
+                Style="{StaticResource InfoButtonStyle}"
+                Click="Btn_Click" />
+        <Popup x:Name="InfoPopup"
+               StaysOpen="False"
+               AllowsTransparency="True"
+               Placement="Bottom"
+               PlacementTarget="{Binding ElementName=Btn}"
+               MaxWidth="340">
+            <Border Background="{DynamicResource SurfaceBrush}"
+                    BorderBrush="{DynamicResource BorderStrongBrush}"
+                    BorderThickness="1"
+                    CornerRadius="8"
+                    Padding="14,10">
+                <Border.Effect>
+                    <DropShadowEffect ShadowDepth="2" BlurRadius="10" Opacity="0.18" Color="#000000" />
+                </Border.Effect>
+                <StackPanel MaxWidth="310">
+                    <TextBlock Text="{Binding Title, ElementName=Root}"
+                               FontWeight="SemiBold"
+                               FontSize="13"
+                               Margin="0,0,0,6"
+                               TextWrapping="Wrap" />
+                    <TextBlock Text="{Binding Body, ElementName=Root}"
+                               FontSize="12"
+                               TextWrapping="Wrap"
+                               LineHeight="18" />
+                </StackPanel>
+            </Border>
+        </Popup>
+    </Grid>
+</UserControl>

SharepointToolbox/Views/Common/InfoButton.xaml.cs

@@ -0,0 +1,36 @@
+using System.Windows;
+using System.Windows.Controls;
+
+namespace SharepointToolbox.Views.Common
+{
+    public partial class InfoButton : UserControl
+    {
+        public static readonly DependencyProperty TitleProperty =
+            DependencyProperty.Register(nameof(Title), typeof(string), typeof(InfoButton), new PropertyMetadata(string.Empty));
+
+        public static readonly DependencyProperty BodyProperty =
+            DependencyProperty.Register(nameof(Body), typeof(string), typeof(InfoButton), new PropertyMetadata(string.Empty));
+
+        public string Title
+        {
+            get => (string)GetValue(TitleProperty);
+            set => SetValue(TitleProperty, value);
+        }
+
+        public string Body
+        {
+            get => (string)GetValue(BodyProperty);
+            set => SetValue(BodyProperty, value);
+        }
+
+        public InfoButton()
+        {
+            InitializeComponent();
+        }
+
+        private void Btn_Click(object sender, RoutedEventArgs e)
+        {
+            InfoPopup.IsOpen = !InfoPopup.IsOpen;
+        }
+    }
+}

SharepointToolbox/Views/Tabs/BulkMembersView.xaml

@@ -8,8 +8,13 @@
         <ScrollViewer DockPanel.Dock="Left" Width="240" Margin="0,0,10,0"
                       VerticalScrollBarVisibility="Auto" HorizontalScrollBarVisibility="Disabled">
         <StackPanel>
+            <StackPanel Orientation="Horizontal" Margin="0,0,0,5">
                 <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[bulkmembers.import]}"
-                    Command="{Binding ImportCsvCommand}" Margin="0,0,0,5" />
+                        Command="{Binding ImportCsvCommand}" />
+                <common:InfoButton Margin="6,0,0,0"
+                                   Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.bulkmembers.title]}"
+                                   Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.bulkmembers.body]}" />
+            </StackPanel>
             <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[bulkmembers.example]}"
                     Command="{Binding LoadExampleCommand}" Margin="0,0,0,10" />
 
@@ -41,8 +46,8 @@
                 <Style TargetType="DataGridRow">
                     <Style.Triggers>
                         <DataTrigger Binding="{Binding IsValid}" Value="False">
-                            <Setter Property="Background" Value="#FFFDE0E0" />
-                            <Setter Property="Foreground" Value="#FFB00020" />
+                            <Setter Property="Background" Value="{DynamicResource ErrorRowBgBrush}" />
+                            <Setter Property="Foreground" Value="{DynamicResource ErrorRowFgBrush}" />
                         </DataTrigger>
                     </Style.Triggers>
                 </Style>

SharepointToolbox/Views/Tabs/BulkSitesView.xaml

@@ -7,8 +7,13 @@
         <ScrollViewer DockPanel.Dock="Left" Width="240" Margin="0,0,10,0"
                       VerticalScrollBarVisibility="Auto" HorizontalScrollBarVisibility="Disabled">
         <StackPanel>
+            <StackPanel Orientation="Horizontal" Margin="0,0,0,5">
                 <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[bulksites.import]}"
-                    Command="{Binding ImportCsvCommand}" Margin="0,0,0,5" />
+                        Command="{Binding ImportCsvCommand}" />
+                <common:InfoButton Margin="6,0,0,0"
+                                   Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.bulksites.title]}"
+                                   Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.bulksites.body]}" />
+            </StackPanel>
             <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[bulksites.example]}"
                     Command="{Binding LoadExampleCommand}" Margin="0,0,0,10" />
 
@@ -39,8 +44,8 @@
                 <Style TargetType="DataGridRow">
                     <Style.Triggers>
                         <DataTrigger Binding="{Binding IsValid}" Value="False">
-                            <Setter Property="Background" Value="#FFFDE0E0" />
-                            <Setter Property="Foreground" Value="#FFB00020" />
+                            <Setter Property="Background" Value="{DynamicResource ErrorRowBgBrush}" />
+                            <Setter Property="Foreground" Value="{DynamicResource ErrorRowFgBrush}" />
                         </DataTrigger>
                     </Style.Triggers>
                 </Style>

SharepointToolbox/Views/Tabs/DuplicatesView.xaml

@@ -1,7 +1,8 @@
 <UserControl x:Class="SharepointToolbox.Views.Tabs.DuplicatesView"
              xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
-             xmlns:loc="clr-namespace:SharepointToolbox.Localization">
+             xmlns:loc="clr-namespace:SharepointToolbox.Localization"
+             xmlns:common="clr-namespace:SharepointToolbox.Views.Common">
     <DockPanel LastChildFill="True">
         <!-- Options panel -->
         <ScrollViewer DockPanel.Dock="Left" Width="240" VerticalScrollBarVisibility="Auto" Margin="8,8,4,8">
@@ -15,7 +16,15 @@
                     </StackPanel>
                 </GroupBox>
 
-                <GroupBox Header="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[grp.dup.criteria]}" Margin="0,0,0,8">
+                <GroupBox Margin="0,0,0,8">
+                    <GroupBox.Header>
+                        <StackPanel Orientation="Horizontal" VerticalAlignment="Center">
+                            <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[grp.dup.criteria]}" VerticalAlignment="Center" />
+                            <common:InfoButton Margin="6,0,0,0"
+                                               Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.dup.criteria.title]}"
+                                               Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.dup.criteria.body]}" />
+                        </StackPanel>
+                    </GroupBox.Header>
                     <StackPanel Margin="4">
                         <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[lbl.dup.note]}"
                                    TextWrapping="Wrap" FontSize="11" Foreground="{DynamicResource TextMutedBrush}" Margin="0,0,0,6" />

SharepointToolbox/Views/Tabs/FolderStructureView.xaml

@@ -12,8 +12,13 @@
                        Margin="0,0,0,3" />
             <TextBox Text="{Binding LibraryTitle, UpdateSourceTrigger=PropertyChanged}" Margin="0,0,0,10" />
 
+            <StackPanel Orientation="Horizontal" Margin="0,0,0,5">
                 <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[folderstruct.import]}"
-                    Command="{Binding ImportCsvCommand}" Margin="0,0,0,5" />
+                        Command="{Binding ImportCsvCommand}" />
+                <common:InfoButton Margin="6,0,0,0"
+                                   Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.folderstruct.title]}"
+                                   Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.folderstruct.body]}" />
+            </StackPanel>
             <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[folderstruct.example]}"
                     Command="{Binding LoadExampleCommand}" Margin="0,0,0,10" />
 

SharepointToolbox/Views/Tabs/PermissionsView.xaml

@@ -34,8 +34,13 @@
           <!-- Checkboxes -->
           <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.scan.folders]}"
                     IsChecked="{Binding ScanFolders}" Margin="0,0,0,4" />
+          <StackPanel Orientation="Horizontal" Margin="0,0,0,4">
             <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.inherited.perms]}"
-                    IsChecked="{Binding IncludeInherited}" Margin="0,0,0,4" />
+                      IsChecked="{Binding IncludeInherited}" VerticalAlignment="Center" />
+            <common:InfoButton Margin="6,0,0,0"
+                               Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.perm.inherited.title]}"
+                               Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.perm.inherited.body]}" />
+          </StackPanel>
           <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.recursive]}"
                     IsChecked="{Binding IncludeSubsites}" Margin="0,0,0,8" />
 
@@ -57,8 +62,13 @@
         <StackPanel>
 
           <!-- Simplified Mode toggle -->
+          <StackPanel Orientation="Horizontal" Margin="0,0,0,8">
             <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.simplified.mode]}"
-                    IsChecked="{Binding IsSimplifiedMode}" Margin="0,0,0,8" />
+                      IsChecked="{Binding IsSimplifiedMode}" VerticalAlignment="Center" />
+            <common:InfoButton Margin="6,0,0,0"
+                               Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.perm.simplified.title]}"
+                               Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.perm.simplified.body]}" />
+          </StackPanel>
 
           <!-- Detail Level radio buttons (only enabled when simplified mode is on) -->
           <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[lbl.detail.level]}"
@@ -90,8 +100,46 @@
       <GroupBox Header="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[audit.grp.export]}"
                 DockPanel.Dock="Top" Margin="0,0,0,8" Padding="8">
         <StackPanel>
+          <StackPanel Orientation="Horizontal" Margin="0,0,0,4">
             <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.merge.permissions]}"
-                    IsChecked="{Binding MergePermissions}" />
+                      IsChecked="{Binding MergePermissions}" VerticalAlignment="Center" />
+            <common:InfoButton Margin="6,0,0,0"
+                               Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.perm.merge.title]}"
+                               Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.perm.merge.body]}" />
+          </StackPanel>
+          <Grid>
+            <Grid.ColumnDefinitions>
+              <ColumnDefinition Width="*" />
+              <ColumnDefinition Width="Auto" />
+            </Grid.ColumnDefinitions>
+            <CheckBox Grid.Column="0" IsChecked="{Binding HideSystemGroupRaw}" VerticalAlignment="Top">
+              <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.hide.system.group.raw]}"
+                         TextWrapping="Wrap" MaxWidth="210" />
+            </CheckBox>
+            <common:InfoButton Grid.Column="1" Margin="6,0,0,0" VerticalAlignment="Top"
+                               Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.perm.hidesys.title]}"
+                               Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.perm.hidesys.body]}" />
+          </Grid>
+          <StackPanel Orientation="Horizontal" Margin="0,6,0,0">
+            <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.exclude.sharing.links]}"
+                      IsChecked="{Binding ExcludeSharingLinks}" VerticalAlignment="Center" />
+            <common:InfoButton Margin="6,0,0,0"
+                               Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.perm.excl.sharing.title]}"
+                               Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.perm.excl.sharing.body]}" />
+          </StackPanel>
+          <Grid Margin="0,4,0,0">
+            <Grid.ColumnDefinitions>
+              <ColumnDefinition Width="*" />
+              <ColumnDefinition Width="Auto" />
+            </Grid.ColumnDefinitions>
+            <CheckBox Grid.Column="0" IsChecked="{Binding ExcludeSystemGroups}" VerticalAlignment="Top">
+              <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.exclude.system.groups]}"
+                         TextWrapping="Wrap" MaxWidth="210" />
+            </CheckBox>
+            <common:InfoButton Grid.Column="1" Margin="6,0,0,0" VerticalAlignment="Top"
+                               Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.perm.excl.system.title]}"
+                               Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.perm.excl.system.body]}" />
+          </Grid>
         </StackPanel>
       </GroupBox>
 
@@ -111,7 +159,12 @@
                   Command="{Binding CancelCommand}"
                   Margin="0,0,0,4" Padding="6,3" />
         </Grid>
-        <Label Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[export.split.label]}" Padding="0,2" />
+        <StackPanel Orientation="Horizontal" Margin="0,0,0,2">
+          <Label Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[export.split.label]}" Padding="0,2" VerticalAlignment="Center" />
+          <common:InfoButton Margin="4,0,0,0"
+                             Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.perm.splitmode.title]}"
+                             Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.perm.splitmode.body]}" />
+        </StackPanel>
         <ComboBox SelectedIndex="{Binding SplitModeIndex}" Height="24" Margin="0,0,0,4">
             <ComboBoxItem Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[export.split.single]}" />
             <ComboBoxItem Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[export.split.bySite]}" />

SharepointToolbox/Views/Tabs/SearchView.xaml

@@ -1,19 +1,32 @@
 <UserControl x:Class="SharepointToolbox.Views.Tabs.SearchView"
              xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
-             xmlns:loc="clr-namespace:SharepointToolbox.Localization">
+             xmlns:loc="clr-namespace:SharepointToolbox.Localization"
+             xmlns:common="clr-namespace:SharepointToolbox.Views.Common">
     <DockPanel LastChildFill="True">
         <!-- Filters panel -->
         <ScrollViewer DockPanel.Dock="Left" Width="260" VerticalScrollBarVisibility="Auto" Margin="8,8,4,8">
             <StackPanel>
-                <GroupBox Header="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[grp.search.filters]}"
-                          Margin="0,0,0,8">
+                <GroupBox Margin="0,0,0,8">
+                    <GroupBox.Header>
+                        <StackPanel Orientation="Horizontal" VerticalAlignment="Center">
+                            <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[grp.search.filters]}" VerticalAlignment="Center" />
+                            <common:InfoButton Margin="6,0,0,0"
+                                               Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.search.title]}"
+                                               Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.search.body]}" />
+                        </StackPanel>
+                    </GroupBox.Header>
                     <StackPanel Margin="4">
                         <Label Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[lbl.extensions]}" Padding="0,0,0,2" />
                         <TextBox Text="{Binding Extensions, UpdateSourceTrigger=PropertyChanged}" Height="26"
                                  ToolTip="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[ph.extensions]}" Margin="0,0,0,6" />
 
-                        <Label Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[lbl.regex]}" Padding="0,0,0,2" />
+                        <StackPanel Orientation="Horizontal" Margin="0,0,0,2">
+                            <Label Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[lbl.regex]}" Padding="0" VerticalAlignment="Center" />
+                            <common:InfoButton Margin="4,0,0,0"
+                                               Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.search.regex.title]}"
+                                               Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.search.regex.body]}" />
+                        </StackPanel>
                         <TextBox Text="{Binding Regex, UpdateSourceTrigger=PropertyChanged}" Height="26"
                                  ToolTip="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[ph.regex]}" Margin="0,0,0,6" />
 

SharepointToolbox/Views/Tabs/StorageView.xaml

@@ -3,11 +3,12 @@
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
              xmlns:loc="clr-namespace:SharepointToolbox.Localization"
              xmlns:conv="clr-namespace:SharepointToolbox.Views.Converters"
-             xmlns:lvc="clr-namespace:LiveChartsCore.SkiaSharpView.WPF;assembly=LiveChartsCore.SkiaSharpView.WPF">
+             xmlns:lvc="clr-namespace:LiveChartsCore.SkiaSharpView.WPF;assembly=LiveChartsCore.SkiaSharpView.WPF"
+             xmlns:common="clr-namespace:SharepointToolbox.Views.Common">
     <DockPanel LastChildFill="True">
         <!-- Options panel -->
         <ScrollViewer DockPanel.Dock="Left" Width="240" VerticalScrollBarVisibility="Auto"
-                      Margin="8,8,4,8">
+                      HorizontalScrollBarVisibility="Disabled" Margin="8,8,4,8">
             <StackPanel>
 
                 <!-- Scan options group -->
@@ -37,10 +38,20 @@
                 <GroupBox Header="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[grp.scan.sources]}"
                           Margin="0,0,0,8">
                     <StackPanel Margin="4">
+                        <StackPanel Orientation="Horizontal" Margin="0,2">
                             <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.scan.hidden]}"
-                                  IsChecked="{Binding ScanHiddenLibraries}" Margin="0,2" />
+                                      IsChecked="{Binding ScanHiddenLibraries}" VerticalAlignment="Center" />
+                            <common:InfoButton Margin="6,0,0,0"
+                                               Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.storage.hidden.title]}"
+                                               Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.storage.hidden.body]}" />
+                        </StackPanel>
+                        <StackPanel Orientation="Horizontal" Margin="0,2">
                             <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.scan.preservation]}"
-                                  IsChecked="{Binding ScanPreservationHold}" Margin="0,2" />
+                                      IsChecked="{Binding ScanPreservationHold}" VerticalAlignment="Center" />
+                            <common:InfoButton Margin="6,0,0,0"
+                                               Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.storage.preservation.title]}"
+                                               Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.storage.preservation.body]}" />
+                        </StackPanel>
                         <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.scan.attachments]}"
                                   IsChecked="{Binding ScanListAttachments}" Margin="0,2" />
                         <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.scan.recyclebin]}"
@@ -65,8 +76,10 @@
                         <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.show.subsites]}"
                                   IsChecked="{Binding ShowSubsites}" Margin="0,2" />
                         <Separator Margin="0,4" />
-                        <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.combine.recyclebin]}"
-                                  IsChecked="{Binding CombineRecycleBinStages}" Margin="0,2" />
+                        <CheckBox IsChecked="{Binding CombineRecycleBinStages}" Margin="0,2">
+                            <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.combine.recyclebin]}"
+                                       TextWrapping="Wrap" MaxWidth="195" />
+                        </CheckBox>
                     </StackPanel>
                 </GroupBox>
 

SharepointToolbox/Views/Tabs/TemplatesView.xaml

@@ -1,15 +1,23 @@
 <UserControl x:Class="SharepointToolbox.Views.Tabs.TemplatesView"
              xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
-             xmlns:loc="clr-namespace:SharepointToolbox.Localization">
+             xmlns:loc="clr-namespace:SharepointToolbox.Localization"
+             xmlns:common="clr-namespace:SharepointToolbox.Views.Common">
     <DockPanel Margin="10">
         <!-- Left panel: Capture and Apply -->
         <ScrollViewer DockPanel.Dock="Left" Width="320" Margin="0,0,10,0"
                       VerticalScrollBarVisibility="Auto" HorizontalScrollBarVisibility="Disabled">
         <StackPanel>
             <!-- Capture Section -->
-            <GroupBox Header="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[templates.capture]}"
-                      Margin="0,0,0,10">
+            <GroupBox Margin="0,0,0,10">
+                <GroupBox.Header>
+                    <StackPanel Orientation="Horizontal" VerticalAlignment="Center">
+                        <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[templates.capture]}" VerticalAlignment="Center" />
+                        <common:InfoButton Margin="6,0,0,0"
+                                           Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.templates.capture.title]}"
+                                           Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.templates.capture.body]}" />
+                    </StackPanel>
+                </GroupBox.Header>
                 <StackPanel Margin="5">
                     <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[templates.name]}"
                                Margin="0,0,0,3" />
@@ -35,8 +43,15 @@
             </GroupBox>
 
             <!-- Apply Section -->
-            <GroupBox Header="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[templates.apply]}"
-                      Margin="0,0,0,10">
+            <GroupBox Margin="0,0,0,10">
+                <GroupBox.Header>
+                    <StackPanel Orientation="Horizontal" VerticalAlignment="Center">
+                        <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[templates.apply]}" VerticalAlignment="Center" />
+                        <common:InfoButton Margin="6,0,0,0"
+                                           Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.templates.apply.title]}"
+                                           Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.templates.apply.body]}" />
+                    </StackPanel>
+                </GroupBox.Header>
                 <StackPanel Margin="5">
                     <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[templates.newtitle]}"
                                Margin="0,0,0,3" />

SharepointToolbox/Views/Tabs/TransferView.xaml

@@ -24,14 +24,24 @@
                         <TextBlock Foreground="{DynamicResource AccentBrush}" FontStyle="Italic" FontSize="11"
                                    Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[transfer.text.files_selected]}" />
                     </StackPanel>
+                            <StackPanel Orientation="Horizontal" Margin="0,6,0,0">
                         <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[transfer.chk.include_source]}"
                                   IsChecked="{Binding IncludeSourceFolder}"
-                              Margin="0,6,0,0"
+                                  VerticalAlignment="Center"
                                   ToolTip="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[transfer.chk.include_source.tooltip]}" />
+                        <common:InfoButton Margin="6,0,0,0"
+                                           Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.transfer.incsource.title]}"
+                                           Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.transfer.incsource.body]}" />
+                    </StackPanel>
+                    <StackPanel Orientation="Horizontal" Margin="0,4,0,0">
                         <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[transfer.chk.copy_contents]}"
                                   IsChecked="{Binding CopyFolderContents}"
-                              Margin="0,4,0,0"
+                                  VerticalAlignment="Center"
                                   ToolTip="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[transfer.chk.copy_contents.tooltip]}" />
+                        <common:InfoButton Margin="6,0,0,0"
+                                           Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.transfer.copycontent.title]}"
+                                           Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.transfer.copycontent.body]}" />
+                    </StackPanel>
                 </StackPanel>
             </GroupBox>
 
@@ -61,8 +71,15 @@
             </GroupBox>
 
             <!-- Conflict Policy -->
-            <GroupBox Header="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[transfer.conflict]}"
-                      Margin="0,0,0,10">
+            <GroupBox Margin="0,0,0,10">
+                <GroupBox.Header>
+                    <StackPanel Orientation="Horizontal" VerticalAlignment="Center">
+                        <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[transfer.conflict]}" VerticalAlignment="Center" />
+                        <common:InfoButton Margin="6,0,0,0"
+                                           Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.transfer.conflict.title]}"
+                                           Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.transfer.conflict.body]}" />
+                    </StackPanel>
+                </GroupBox.Header>
                 <ComboBox SelectedIndex="0" x:Name="ConflictCombo" SelectionChanged="ConflictCombo_SelectionChanged">
                     <ComboBoxItem Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[transfer.conflict.skip]}" />
                     <ComboBoxItem Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[transfer.conflict.overwrite]}" />

SharepointToolbox/Views/Tabs/UserAccessAuditView.xaml

@@ -22,9 +22,12 @@
       <StackPanel DockPanel.Dock="Top" Orientation="Horizontal" Margin="0,0,0,8">
         <RadioButton Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[audit.mode.search]}"
                      IsChecked="{Binding IsBrowseMode, Converter={StaticResource InverseBoolConverter}}"
-                     Margin="0,0,12,0" />
+                     Margin="0,0,12,0" VerticalAlignment="Center" />
         <RadioButton Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[audit.mode.browse]}"
-                     IsChecked="{Binding IsBrowseMode}" />
+                     IsChecked="{Binding IsBrowseMode}" VerticalAlignment="Center" />
+        <common:InfoButton Margin="8,0,0,0"
+                           Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.audit.mode.title]}"
+                           Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.audit.mode.body]}" />
       </StackPanel>
 
       <!-- SEARCH MODE PANEL (visible when IsBrowseMode=false) -->
@@ -201,8 +204,15 @@
       </StackPanel>
 
       <!-- Scan Options (always visible) -->
-      <GroupBox Header="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[audit.grp.options]}"
-                DockPanel.Dock="Top" Margin="0,0,0,8" Padding="8">
+      <GroupBox DockPanel.Dock="Top" Margin="0,0,0,8" Padding="8">
+        <GroupBox.Header>
+          <StackPanel Orientation="Horizontal" VerticalAlignment="Center">
+            <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[audit.grp.options]}" VerticalAlignment="Center" />
+            <common:InfoButton Margin="6,0,0,0"
+                               Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.audit.vs.perms.title]}"
+                               Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.audit.vs.perms.body]}" />
+          </StackPanel>
+        </GroupBox.Header>
         <StackPanel>
           <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[chk.inherited.perms]}"
                     IsChecked="{Binding IncludeInherited}" Margin="0,0,0,4" />

SharepointToolbox/Views/Tabs/VersionCleanupView.xaml

@@ -1,7 +1,8 @@
 <UserControl x:Class="SharepointToolbox.Views.Tabs.VersionCleanupView"
              xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
-             xmlns:loc="clr-namespace:SharepointToolbox.Localization">
+             xmlns:loc="clr-namespace:SharepointToolbox.Localization"
+             xmlns:common="clr-namespace:SharepointToolbox.Views.Common">
   <DockPanel LastChildFill="True">
     <ScrollViewer DockPanel.Dock="Left" Width="280" VerticalScrollBarVisibility="Auto" Margin="8,8,4,8">
       <StackPanel>
@@ -17,8 +18,15 @@
           </StackPanel>
         </GroupBox>
 
-        <GroupBox Header="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[versions.grp.policy]}"
-                  Margin="0,0,0,8">
+        <GroupBox Margin="0,0,0,8">
+          <GroupBox.Header>
+            <StackPanel Orientation="Horizontal" VerticalAlignment="Center">
+              <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[versions.grp.policy]}" VerticalAlignment="Center" />
+              <common:InfoButton Margin="6,0,0,0"
+                                 Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.versions.policy.title]}"
+                                 Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.versions.policy.body]}" />
+            </StackPanel>
+          </GroupBox.Header>
           <StackPanel Margin="4">
             <StackPanel Orientation="Horizontal" Margin="0,2">
               <Label Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[versions.lbl.keepLast]}"
@@ -26,10 +34,20 @@
               <TextBox Text="{Binding KeepLast, UpdateSourceTrigger=PropertyChanged}"
                        Width="50" Height="22" VerticalAlignment="Center" />
             </StackPanel>
+            <StackPanel Orientation="Horizontal" Margin="0,4,0,2">
               <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[versions.chk.keepFirst]}"
-                      IsChecked="{Binding KeepFirstVersion}" Margin="0,4,0,2" />
+                        IsChecked="{Binding KeepFirstVersion}" VerticalAlignment="Center" />
+              <common:InfoButton Margin="6,0,0,0"
+                                 Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.versions.keepfirst.title]}"
+                                 Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.versions.keepfirst.body]}" />
+            </StackPanel>
+            <StackPanel Orientation="Horizontal" Margin="0,4,0,2">
               <CheckBox Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[versions.chk.confirm]}"
-                      IsChecked="{Binding ConfirmDelete}" Margin="0,4,0,2" />
+                        IsChecked="{Binding ConfirmDelete}" VerticalAlignment="Center" />
+              <common:InfoButton Margin="6,0,0,0"
+                                 Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.versions.confirm.title]}"
+                                 Body="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[help.versions.confirm.body]}" />
+            </StackPanel>
             <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[versions.note]}"
                        TextWrapping="Wrap" FontSize="11" Foreground="{DynamicResource TextMutedBrush}"
                        Margin="0,6,0,0" />