The best way to manage SharePoint permissions is to keep them simple. Give people the least access they need. Grant it through groups rather than named individuals. Break inheritance rarely. Review who has access on a schedule. Follow those four habits and most permission problems never appear.

This guide walks through how to do that in practice, with the reasoning behind each step. It is written for business owners and the people who look after Microsoft 365 in small and medium-sized firms.

TL;DR

• Give each person the lowest permission level that lets them do their job, and use the built-in Owners, Members and Visitors groups instead of individual grants.
• For sites connected to Microsoft Teams or a Microsoft 365 group, manage access through the group, not inside SharePoint.
• Set permissions at site or library level. Unique permissions on single folders and files are the main cause of messy, slow and hard-to-audit sites.
• Keep sensitive data in its own site with external sharing switched off, and review access regularly, including when people leave.

Table of Contents

• How SharePoint permissions work, in plain terms
• Start with least privilege
• Use groups, never individuals
• Keep group-connected sites aligned with the group
• Set permissions high, and break inheritance sparingly
• A worked example: a small professional firm
• Isolate sensitive data and control external sharing
• Why this matters under UK data protection law
• Treat access as a routine, not a one-off job
• Common mistakes we see
• Our perspective: simple permissions are safer permissions
• Getting help with your SharePoint set-up
• FAQ
• Sources

How SharePoint permissions work, in plain terms

Think of a SharePoint site as a building. The site is the building, libraries are rooms, and folders and files are cabinets inside the rooms. By default, anyone allowed into the building can open every room and cabinet. That is called inheritance: permissions flow downwards from the site unless someone changes them.

Microsoft’s site governance guidance describes three standard groups. Owners have Full Control, Members can add, edit and delete, and Visitors have read-only access. Most small businesses can run their whole file structure on those three roles alone.

The trouble starts when someone needs “just this one folder” shared with “just this one person”. Each exception is small. Add up a few years of them and nobody can say who can see what.

Start with least privilege

The first principle in Microsoft’s governance advice is the Principle of Least Privilege: give people the lowest permission level they need to do their assigned tasks.

In a ten-person firm this usually looks like:

• Owners: two people, for example the office manager and the director. Not everyone who is “good with computers”.
• Members: staff who create and edit documents day to day.
• Visitors: people who only need to read, such as a policy library everyone consults but only a few edit.

A common mistake is making every member of staff an Owner so that nobody has to ask for help. Owners can change permissions and share content freely, so one careless click can expose an entire site. Edit rights are enough for most people.

Use groups, never individuals

Granting access to named people feels quicker on the day. Months later it becomes a list nobody can read. Groups give you one place to change access: add someone to the group when they join a team and remove them when they move on.

How you apply this depends on the type of site:

This split matches Microsoft’s guidance on permission levels: use the built-in SharePoint groups for communication sites and manage team site permissions through the associated Microsoft 365 group.

Keep group-connected sites aligned with the group

If a site sits behind a Team, resist the urge to add people directly in SharePoint. Microsoft warns that separate management leads to a fragmented state. Someone can open the files but cannot join the related conversations or see the shared planner.

The Microsoft 365 Groups and SharePoint governance documentation makes the same point. If you add a person through the site and not the group, they may reach the documents but miss the shared mailbox, planner or Teams chat that goes with them.

The practical rule is simple: one team, one group, one place to add or remove people. Keeping membership in step across your collaboration tools also makes day-to-day teamwork smoother, a theme covered in this piece on Microsoft 365 team collaboration benefits.

Set permissions high, and break inheritance sparingly

When you break inheritance on a folder or file, you create a new security scope. Each scope has to be tracked and recalculated by the system. Microsoft’s permission scope guidance says a library can technically hold up to 50,000 unique access control lists, but recommends staying well below 5,000 for performance. Past that, you risk slowdowns.

The same page notes that large access lists cause problems faster than small ones. Keeping each list small is helpful, but the safest approach is still to have as few unique scopes as possible.

For most firms the answer is structural, not technical:

1. Manage security at site level first. If a set of documents needs different people, ask whether it deserves its own site.
2. Use separate libraries where one site must hold two audiences.
3. Allow unique permissions on folders only as a last resort, and never on individual files unless there is a short-lived, documented reason.
4. Write down every exception, including who asked, who approved and when it should end.

If you find yourself breaking inheritance every week, the site design is probably wrong. Fix the design instead.

A worked example: a small professional firm

Imagine a 25-person accountancy practice with three audiences: all staff, the finance team and the directors. A tidy setup could be:

• Intranet (communication site): Visitors group contains all staff, Members group contains the office manager and HR lead, Owners are two directors.
• Finance (team site): access comes from the Finance team’s Microsoft 365 group. Nobody is added directly in SharePoint.
• Directors (private site): a dedicated group of directors only, external sharing off.
• Client folders: a library inside Finance, with folders per client but no folder-level permissions, because everyone in Finance may see them.

There are four sites and four sets of group memberships. A new starter in finance is added to one group and gets the right access everywhere. When they leave, removing them from that one group ends their access.

Isolate sensitive data and control external sharing

Sharing with clients and suppliers is normal. The risk is that sensitive material sits in a site where sharing is open to everyone. Microsoft’s external sharing overview lets you set sharing per site, and it can be stricter than the organisation-wide setting. For payroll, HR, legal or client financial records, create a dedicated site with external sharing off. A mistaken link then cannot leave the building.

For a stronger boundary, Microsoft’s restricted site access control limits a site and its content to designated Microsoft 365 or Microsoft Entra security groups. People outside those groups are blocked, even if they previously held permissions or a sharing link. You can designate up to 10 groups per site. It is a useful safety net where old, forgotten access might otherwise linger.

A few other habits help:

• Prefer links for specific people over “anyone with the link”.
• Set expiry dates on guest access where you can.
• Turn on multi-factor authentication for everyone, guests included. We cover your options in our guide to Microsoft 365 MFA for SMEs.
• Consider conditional access for sensitive sites, testing it first in report-only mode as we describe in this conditional access guide.

Why this matters under UK data protection law

Permissions are not only an IT tidiness issue. If your SharePoint holds personal data about clients, staff or patients, UK GDPR expects sensible controls. The ICO’s cloud computing guidance says staff should have their own individual accounts rather than shared credentials, and that access should be removed promptly when someone leaves.

The ICO’s access control toolkit also points to documenting a process for staff who move roles. That covers the quieter risk: someone changes department and keeps old access forever. The ICO notes this guidance is under review following the Data (Use and Access) Act, so check the current version before you rely on it.

If you need a rulebook for how long to keep files, our guide to making a UK data retention policy enforceable pairs well with this one. Less stored data means less to protect.

Treat access as a routine, not a one-off job

Permissions drift. People change roles, projects end and guests are never removed. The ICO’s audit case studies show organisations learning that access control is an ongoing process, with regular audits, log reviews and security assessments for new projects.

A lightweight review routine for a small firm:

1. Every month: check the leaver list against the Microsoft 365 user list and remove anyone who should not be there.
2. Every quarter: read the membership of each Owners group and each sensitive site’s group. Ask whether each person still needs it.
3. Every six months: review guest users and shared links, and delete the ones no one can explain.
4. At every new project: decide the audience before creating the site, not after.

Keep a short record of what you checked and when. It takes less time than it sounds, and it is good evidence if you are ever asked how you control access.

Common mistakes we see

• Everyone is an Owner. It stops support requests but removes all control.
• Folder-by-folder permissions. They multiply over time and make audits almost impossible.
• Adding users directly to a Teams-connected site. This causes the half-access problem described above.
• Forgotten guests. A supplier from a finished project still holds a link two years later.
• No second Owner. If the only Owner leaves, nobody can fix access when something breaks. Always name at least two.
• Permissions without backup. Accidental deletion or oversharing cleanup can remove content. See our look at Microsoft 365 backup for SMEs for when native protection is enough.

Our perspective: simple permissions are safer permissions

At CTA Systems we look after Microsoft 365 for small businesses, and a tangled permission structure is one of the most common things we find when we start working with a new client. It is rarely anyone’s fault. A site starts small, a few quick exceptions are made to help a colleague, and years later the structure is a maze.

Our approach follows how we work generally: prevent the problem rather than repair it later. We would rather agree a handful of groups with you at the start, keep them aligned with your teams, and check them on a schedule. Staff then know where files live, and you know who can reach them.

The analogy we like is a garden. A few well-placed paths are easy to maintain. If every visitor gets their own private gate, weeds soon take over. Fewer rules, applied consistently, beat clever rules nobody remembers.

There is also a people side. Staff who understand why a folder is restricted are far less likely to look for workarounds. A short training session on sharing links, and on what “anyone with the link” really means, often prevents more incidents than any setting. If your team is new to the platform, our role-based Microsoft 365 training plan is a good place to start.

— Will

Getting help with your SharePoint set-up

If you suspect your SharePoint has outgrown its original design, we can review it with you: who has access, where inheritance is broken, and which sites hold sensitive data. We support businesses across Warrington, Widnes, St Helens, Runcorn and the surrounding areas, and our Microsoft 365 service covers set-up, management and user support. Our care plans add proactive monitoring and regular checks, so permissions stay tidy after the initial clean-up. To talk it through, contact us.

FAQ

What is the best way to manage SharePoint access?

Use groups, not individuals. For communication sites, use the built-in Owners, Members and Visitors groups. For team sites connected to Teams, manage access through the Microsoft 365 group. Keep at least two Owners, and review membership regularly.

Should I set permissions on individual folders?

Avoid it where you can. Each unique permission adds a security scope that must be tracked and recalculated, and Microsoft recommends keeping unique scopes well below 5,000 per library. If a folder needs a different audience, a separate library or site is usually cleaner.

How do I stop sensitive files being shared outside the company?

Put them in a dedicated site and turn external sharing off for that site, even if the organisation allows it elsewhere. You can add restricted site access control so only named groups can open the site at all. Combine this with multi-factor authentication for all accounts.

How often should we review SharePoint permissions?

A monthly check for leavers, a quarterly look at Owners and sensitive sites, and a six-monthly review of guests and sharing links works for most small firms. Review also whenever a project ends or someone changes role. The ICO treats access control as a continuing process, not a one-time setting.

Sources

• Overview: Site governance, permission and sharing for site owners (Microsoft Support)
• Understanding permission levels in SharePoint (Microsoft Learn)
• Sharing and permissions in the SharePoint modern experience (Microsoft Learn)
• SharePoint and Microsoft 365 Groups integration (Microsoft Learn)
• Manage permission scopes in SharePoint (Microsoft Learn)
• Overview of external sharing in SharePoint and OneDrive (Microsoft Learn)
• Restrict SharePoint site access with Microsoft 365 groups and Microsoft Entra security groups (Microsoft Learn)
• Cloud computing guidance for organisations (ICO)
• Access control toolkit (ICO)
• Data protection audit framework case studies (ICO)

Recommended

• 8–12 Week Microsoft 365 Training for SMEs: Role Based Plan & Support
• Microsoft 365 MFA for SMEs: 3 Routes, Why Defaults Come First
• IT Teams: Test Conditional Access Policies in Report Only