← Al Davies, 250 High Street

SharePoint permissions best practices for a small team

Give access to groups, not to single people, and keep the default permission inheritance unless you have a clear reason to break it. On a team site, manage who is in the Microsoft 365 group. On a communication site, use the Owners, Members and Visitors groups.

What are the SharePoint permission levels?

Microsoft ships a set of default permission levels. The ones a small team meets most are Full Control, Edit, Contribute and Read. Menu names can differ between tenants, so check your own screen if a step looks different.

Microsoft describes Edit as the right to add, edit and delete lists, and to view, add, update and delete list items and documents. Contribute lets a person view, add, update and delete items and documents, but not manage lists. Read lets a person view pages and items and download documents.

  1. Full Control: all available permissions. The Owners group has it by default.
  2. Edit: the Members group has it by default.
  3. Read: the Visitors group has it by default.
  4. View Only: people can view in the browser, but files with no browser viewer can still be downloaded.

Who should be an Owner, a Member or a Visitor?

A simple rule works for a small team. Owners run the site, so keep them to two or three people. Members add and change content. Visitors only read.

Microsoft says a communication site normally has one or more owners, a small number of members who create content, and a large number of visitors. For a team site, Microsoft says to manage permissions through the Microsoft 365 group or the Teams team. Group owners become site owners, and group members become site members. A Microsoft 365 group has no view-only access, so add read-only people straight to the site Visitors group.

Should you add people one by one or use groups?

Use groups. Microsoft says you can add individual users, security groups or Microsoft 365 groups to the Owners, Members and Visitors groups. It notes that the Visitors group is a good place for security groups, and that nested security groups can cause performance problems.

When a person leaves, you change one group and the access follows. This part is advice from our own work, not a Microsoft rule.

Why keep permission inheritance?

By design, lists, libraries and items inherit permissions from the site above them. Microsoft calls breaking inheritance supported but not recommended, because built-in groups and Microsoft 365 group permissions are easier to administer.

Two facts to know before you break it. Sharing a single item with someone who has no access breaks inheritance on that item automatically, and later changes to the parent do not apply to it. And if you remove a user or group from a parent, they also leave all the children, and Microsoft says restoring them is not possible.

How do you give one list its own permissions?

Sometimes one list holds data that not everyone should open, like pay or reviews. Break inheritance on that one list, not on the whole site.

If the real need is that people see only their own rows, a list setting may be enough. See our guide on letting people see only their own items. If the need is to hide one field, see hiding a column from some people.

  1. Open the list.
  2. Select Settings (the gear icon), then List settings. You may need More list settings.
  3. Under Permissions and Management, select Permissions for this list.
  4. Select Stop Inheriting Permissions.
  5. Select Grant Permissions to add the people who need access.

Microsoft lists three main link types. Anyone links work for anyone who has the link, including people outside your company, with no sign in, and their use cannot be audited. People in your organization links work only for people inside your Microsoft 365 organization. Specific people links work only for the names you enter.

For a small team, choose Specific people when the file is sensitive. Microsoft also advises that confidential material be stored in a site with external sharing turned off.

How do you check who has access, and what keeps it tidy?

Review the Owners, Members and Visitors groups on a set day each quarter. This is a habit we suggest, not a Microsoft step.

Also plan for the person who owns your flows and lists. See our guide on what happens when a flow owner leaves, and keep a copy of important data with a list backup.

Want help setting this up?

If you want permissions planned for a tracker, I am Al Davies at 250 High Street LLC. I build SharePoint and Power Automate trackers for small teams, remotely. One tracker is $5,000 and takes 2 weeks, and the first call is free. You can see past work in the portfolio.

FAQ

What is the best way to give a small team access to SharePoint?

Use groups. Manage team site access through the Microsoft 365 group, and communication site access through the Owners, Members and Visitors groups.

Does sharing one file change the permissions?

Yes. Sharing an item with someone who has no access breaks inheritance on that item. Later changes to the parent do not apply to it.

Do Visitors need a Microsoft 365 group?

No. A Microsoft 365 group has no view-only access, so add read-only people to the site Visitors group.

Sources