SharePoint Permissions: A Practical Guide for UK Businesses

SharePoint permissions decide who can open, edit, share and delete your business files. The safest set-up is simple: give access through the built-in groups (Owners, Members and Visitors), keep unique permissions to a minimum, share with named people rather than open links, and review who has access on a schedule. This guide explains how SharePoint permissions work, where small businesses go wrong, and how to build a structure you can still understand in two years’ time.

How SharePoint permissions work

SharePoint uses a hierarchy. Content inherits access from its parent: a file takes its access from the library, the library from the site. Grant someone access at the top and they can see everything beneath it, unless inheritance has been broken somewhere lower down.

Three default groups cover most needs:

Group	Permission level	Typical person
Owners	Full Control	Department lead, IT manager
Members	Edit	Staff who work in the site every day
Visitors	Read	Staff or contractors who only need to view

These are the standard groups described by Microsoft, which also advises using the built-in groups for communication sites and managing team site permissions through the linked Microsoft 365 group. That keeps administration straightforward.

Site permissions: start with the right structure

Most problems with SharePoint site permissions begin at the planning stage. A site created in a hurry, with a vague purpose and a mixed audience, ends up needing exceptions from day one.

Before creating a site, answer three questions:

1. Who is the audience? One site per distinct audience (finance, HR, whole company) is easier to secure than one site with many fenced-off corners.
2. Who owns it? Every site needs at least two named owners, so access decisions do not depend on one person who may leave.
3. Is anyone outside the business involved? If so, decide now whether external sharing is allowed for that site.

Microsoft stresses that planning a logical hierarchy early matters, because access in SharePoint is additive. If someone already has Edit through a group, you cannot simply tell a lower-level setting to override it on one file. You have to remove the route that gives them the access.

For example, a Members group that includes the whole sales team will not let you keep the commission spreadsheet in the same library “view only” for one of them. A separate library or site, with its own small group, is the cleaner answer.

Breaking inheritance without losing control

Sometimes a folder or file does need different access. SharePoint lets you stop inheritance at the site, library, folder or file level and set unique permissions. Use this sparingly.

The quiet danger is that it happens by accident. Sharing a single document with someone who lacks access to its library breaks inheritance for that file. Do that a few hundred times and you have a structure nobody can describe, which makes least privilege very hard to maintain without tooling and regular checks.

Sensible rules for exceptions:

• Prefer a separate library or site over unique permissions on individual files.
• Grant unique access to SharePoint groups or Microsoft 365 groups, never to a long list of individuals.
• Record why each exception exists and who approved it.
• Review exceptions at least as often as you review the rest.

SharePoint sharing settings and link types

Permissions are only half the picture. The other half is the shareable link. Microsoft documents three main link types:

• Anyone: no sign-in needed. Whoever holds the link can use it, and it cannot be audited in the same way.
• People in your organisation: internal staff only, no external guests.
• Specific people: the recipient must authenticate as the named person.

For anything sensitive, use Specific people. It is revocable and auditable. Bear in mind that Microsoft describes these links as working like secret keys, and that files shared this way can become discoverable in search and accessible through Copilot for anyone added to the link. Check the names on a link before you send it, not afterwards.

Sharing is also controlled at tenant and site level. Changing a site’s sharing settings requires at least the SharePoint Administrator role; site owners cannot change them. If you work with clients or suppliers, external or guest sharing lets you collaborate securely with people outside your organisation, but decide deliberately which sites may use it.

SharePoint permissions best practices for small businesses

Good SharePoint governance for a small business does not need a committee. It needs a handful of habits that are actually followed.

1. Apply least privilege. Give people the minimum access they need for their role. Under UK GDPR, organisations must put in place appropriate technical and organisational measures, and the ICO’s records management and security toolkit expects access to personal information to be limited to authorised staff and rights to be regularly reviewed.
2. Use groups, not individuals. Add people to Members or Visitors, not to individual files. When someone moves team, you change one membership.
3. Document joiners, movers and leavers. The same ICO toolkit points to documented processes for new starters and leavers. A mover process matters just as much, because staff who change roles often keep old access. That privilege creep is a classic weakness.
4. Restrict owners and administrators. Keep Full Control and admin roles to a small, approved group. The ICO’s ransomware guidance says the security of privileged accounts should be a high priority, including regular reviews of permissions. Protect those accounts with strong sign-in too; our note on Microsoft 365 MFA for UK admins covers emergency accounts and FIDO2.
5. Review on a calendar. Quarterly for sites holding personal, financial or HR data; annually for the rest.
6. Treat it as a security outcome. The ICO’s guidance on data protection by design and by default means building protection in from the start, not configuring it once and forgetting it.

The same thinking applies to any system that holds staff data. This piece on limiting employee location data is written from a US workforce-software angle, but its argument for collecting and exposing less personal data is the same logic as least privilege.

A simple quarterly access review

You do not need special software to start. Once a quarter, for each important site:

1. List the owners, members and visitors, and confirm every name is a current member of staff or an approved external.
2. Check for libraries, folders or files with unique permissions, and ask whether each is still needed.
3. Review active sharing links, especially Anyone links, and remove any that are no longer in use.
4. Compare the list against your leavers and movers records.
5. Write down what you changed and who signed it off.

The written record matters. If a regulator or a client asks how you control access to personal data, a dated review is far better evidence than good intentions.

Where Abersecure can help

Many businesses in Aberdeen and Aberdeenshire have SharePoint set up by whoever needed it first, then left to grow. If you would like someone to own that tidy-up, our Microsoft 365 Management service is the place to start, and our Managed IT Support works to a Security by Default approach, so protection is part of the support rather than an optional extra. If you want an outside view of your current exposure first, see our cyber security services, or get in touch through our main site.

Frequently asked questions

What are the different SharePoint permissions?

SharePoint uses permission levels such as Full Control, Edit and Read, normally assigned through the Owners, Members and Visitors groups. Microsoft’s permission levels guide lists the full set. For most small businesses, the three default groups are enough.

How do I restrict access to certain people in SharePoint?

The cleanest way is a separate site or library with its own small group, rather than fencing off individual files. If you must restrict a folder, break inheritance there, assign a group, and document the reason. Remember that anyone who already has access through a higher-level group keeps it until you remove that route.

Who can change SharePoint sharing settings?

For site-level external sharing, you need at least the SharePoint Administrator role in Microsoft 365, and site owners cannot change these settings. That is a useful safeguard, so keep that role limited.

Which sharing link should I use for sensitive files?

Use Specific people links. The recipient has to authenticate, and the link can be revoked and audited. Avoid Anyone links for confidential or personal data.

How often should SharePoint permissions be reviewed?

There is no single legal interval, but the ICO expects access rights to be regularly reviewed. Quarterly for sites with personal or sensitive data is a sensible, defensible rhythm for a small business.