SharePoint permissions

Sponsored · Paid partnership with Cognillo

Concept

How access to SharePoint sites and content is controlled: through a Microsoft 365 group or the SharePoint groups Owners, Members and Visitors, and through sharing links for single files and folders.

Description

SharePoint permissions decide who can open, edit or manage a site and its content. Microsoft Learn describes the model by site type. Team sites are by default connected to a Microsoft 365 group: the group owners become site owners and the group members become site members. Communication sites are not connected to a Microsoft 365 group and use the standard SharePoint groups Owners, Members and Visitors. For private and shared channel sites, permissions are managed in Teams.

On a team site, the three groups have the permission levels Full Control (Owners), Edit (Members) and Read (Visitors). A Microsoft 365 group has no view-only access, so people who should only read must be added directly to the Visitors group. Microsoft recommends managing permissions through the Microsoft 365 group or the team where possible, and advises against nested security groups because they can cause performance problems.

Permissions on a site, group or team give access to all content in it. To share a single file or folder, SharePoint offers sharing links of three types: Anyone, People in your organization and Specific people. A site can allow external sharing only if it is allowed at organization level first.

Sources (Microsoft Learn, checked in November 2026): https://learn.microsoft.com/en-us/sharepoint/modern-experience-sharing-permissions , https://learn.microsoft.com/en-us/sharepoint/default-sharepoint-groups

Episodes about SharePoint permissions

Related topics in brief

• SharePoint · Related to · Product
  Microsoft 365's platform for intranets, document libraries and team sites. Most files shared in Teams are stored in SharePoint, so its permissions directly decide what Copilot can find.
• Permission inheritance (SharePoint) · Related to · Concept
• Least privilege · Related to · Concept
  Least privilege is the security principle of giving an identity the smallest role at the smallest scope for the shortest time that still lets it do its work, limiting what an attacker can reach if the account is compromised.
• SharePoint sharing links · Related to · Concept
  Links created with the Share option in SharePoint and OneDrive that grant access to a file or folder, with scopes such as anyone, people in the organization, people with existing access or specific people.
• Oversharing · Related to · Concept
  Content in Microsoft 365 that is shared more broadly than intended, for example through organization-wide or anonymous links, which AI assistants like Copilot can surface to users.
• Guest access · Related to · Concept
  The ability to add people from outside the organization to Microsoft 365 groups and Teams as guest objects in Microsoft Entra ID, controlled at tenant, team and sensitivity-label level.
• Permission drift · Related to · Concept
  Permission drift is the gradual divergence of an access model from current business reality as access keeps evolving through local decisions, role changes, leftover groups and exceptions that are never removed.
• Everyone except external users (EEEU) · Related to · Concept
  Built-in SharePoint and Microsoft 365 claim that includes every internal user of a tenant; granting it access to sites or libraries makes content broadly visible inside the organization.
• Access reviews · Related to · Concept
  Recurring Microsoft Entra reviews that ask designated reviewers whether a person still needs access to a group, application, access package or privileged role, optionally applying removals automatically.
• Cognillo · Related to · Organization
  Software company from Jersey City, New Jersey (legal name Tendero, Inc., doing business as Cognillo) with tools for SharePoint administration and a generative AI platform for software testing; it says it has offered enterprise IT solutions since 2012.
• SharePoint Essentials Toolkit · Related to · Product
  Cognillo tool for SharePoint administrators and site owners: reports on permissions, oversharing and sharing links, a broken link monitor, content tools, SharePoint-to-SharePoint migration, metadata reports and scheduled exports.
• User offboarding (Microsoft 365) · Related to · Concept
  Steps when someone leaves an organization: find and hand over their files and access, then remove the account. In Microsoft 365, deleted accounts can be restored for 30 days by default, and OneDrive data is kept for a limited time.
• SharePoint governance · Related to · Concept
  The policies, roles, responsibilities and processes that control how an organization uses SharePoint: who owns sites, how sites are created and shared, and how content is reviewed.
• SharePoint site owner · Related to · Concept
  A person who manages a SharePoint site: members of the Owners group have Full Control and can manage site permissions, settings and appearance. In a team site, the owners of the connected Microsoft 365 group are the site owners.

Glossary

Experts and companies for this topic

Nobody has listed this topic yet. Add it to your profile.

Experts on related topics

• Mirko Peters ✔ · via SharePoint

Maintained by Mirko Peters (Microsoft MVP) · Last updated: 2026-11-11