{"id":28934,"date":"2024-07-05T15:04:31","date_gmt":"2024-07-05T19:04:31","guid":{"rendered":"https:\/\/www.uvm.edu\/it\/dev\/kb\/?post_type=ht_kb&p=28934"},"modified":"2024-07-05T15:57:09","modified_gmt":"2024-07-05T19:57:09","slug":"sharepoint-online-permissions-management","status":"publish","type":"ht_kb","link":"https:\/\/www.uvm.edu\/it\/dev\/kb\/article\/sharepoint-online-permissions-management\/","title":{"rendered":"SharePoint Online – Permissions Management"},"content":{"rendered":"

Permissions management ensures team members have access to the Sites and the files they need, and ensures former team members no longer have access to data they don’t. This page describes the process.<\/p>\n

Site-wide Permissions<\/h2>\n

There are three default permissions groups that control access to a SharePoint Site:<\/p>\n

    \n
  1. Visitors<\/strong>, who have read<\/strong>-only access,<\/li>\n
  2. Members<\/strong>, who can create and edit<\/strong> files,<\/li>\n
  3. and Owners<\/strong>, who have full control<\/strong> over the Site content and permissions.<\/li>\n<\/ol>\n

    Custom groups and permission levels can be created to fine tune access when those three default groups are not sufficient.<\/p>\n \t\t

    \r\n \t\t\t

    Add Member or Owner<\/h3><\/div>\r\n \t\t\t
    \r\n \t\t\t\t
    \r\n \t\t\t\t\t<\/p>\n

    \n \t\t\tAlternate Method<\/span> \t\t\t \t\t\t\t<\/p>\n

    \n \t\t\t\t\tThese same results can be achieved by modifying the Members or Owners groups instead using the Modify Group Membership<\/a> instructions below. \t\t\t\t<\/p>\n<\/p><\/div>\n

    \n \t\t<\/p>\n

      \n
    1. Click the gear (<\/i><\/strong>) in the top-right corner and select Site permissions<\/strong>.
      \n      \"SPO<\/a><\/li>\n
    2. Click Add members<\/strong> and then Add members to group<\/strong>.
      \n      \"SPO<\/a><\/li>\n
    3. Click Add members<\/strong>.
      \n      \"SPO<\/a><\/li>\n
    4. Start typing a name or email address into the box and then select their account as it appears in the drop-down below.
      \n      \"Add<\/a><\/li>\n
    5. Click the down-caret (<\/i><\/strong>) to the right of their currently-selected role and select the proper level of access.
      \n      \"SPO<\/a><\/li>\n
    6. Repeat steps 4 and 5 for any number of team members. Click Save<\/strong>.<\/li>\n<\/ol>\n

      \n \t\t\t\t<\/div>\r\n \t\t\t<\/div>\r\n \t\t<\/div>\r\n \t\t\n \t\t

      \r\n \t\t\t

      Add Visitor<\/h3><\/div>\r\n \t\t\t
      \r\n \t\t\t\t
      \r\n \t\t\t\t\t<\/p>\n

      \n \t\t\tAlternate Method<\/span> \t\t\t \t\t\t\t<\/p>\n

      \n \t\t\t\t\tThese same results can be achieved by modifying the Visitors group instead using the Modify Group Membership<\/a> instructions below. \t\t\t\t<\/p>\n<\/p><\/div>\n

      \n \t\t<\/p>\n

        \n
      1. Click the gear (<\/i><\/strong>) in the top-right corner and select Site permissions<\/strong>.
        \n        \"SPO<\/a><\/li>\n
      2. Click Add members<\/strong> and then Share site only<\/strong>.
        \n        \"SPO<\/a><\/li>\n
      3. Type an email address into the box and then select it from the search results that drop down.
        \n        \"SPO<\/a><\/li>\n
      4. Click the down caret (<\/i><\/strong>) to the right of their currently-selected role and select Read<\/strong>. Repeat this step for any number of visitors.
        \n        \"SPO<\/a><\/li>\n
      5. Enter a message<\/strong> that the new group of visitors will receive via email, and click Add<\/strong>.
        \n        \"SPO<\/a><\/li>\n<\/ol>\n

        \n \t\t\t\t<\/div>\r\n \t\t\t<\/div>\r\n \t\t<\/div>\r\n \t\t\n \t\t

        \r\n \t\t\t

        Create Custom Group<\/h3><\/div>\r\n \t\t\t
        \r\n \t\t\t\t
        \r\n \t\t\t\t\t<\/p>\n
          \n
        1. Navigate to the following page, replacing MySite<\/strong> with the name of your SharePoint online site.\n
          https:\/\/uvmoffice.sharepoint.com\/sites\/MySite\/_layouts\/15\/groups.aspx<\/pre>\n<\/li>\n
        2. Click New<\/strong> or click the down arrow (<\/i><\/strong>)and select New Group<\/strong>.
          \n\"SPO<\/a><\/li>\n
        3. Enter a Name for the new group and a Description of its purpose.
          \n          \"SPO<\/a><\/li>\n
        4. Review the rest of the group settings as you scroll down to the permission level<\/strong> section. Select the appropriate permission level for future members of this group, and click Create<\/strong>.
          \n          \"SPO<\/a><\/li>\n<\/ol>\n
          \n    \t\t\t\t<\/div>\r\n    \t\t\t<\/div>\r\n    \t\t<\/div>\r\n    \t\t\n    \t\t
          \r\n    \t\t\t
          Modify Group Membership<\/h3><\/div>\r\n    \t\t\t
          \r\n    \t\t\t\t
          \r\n    \t\t\t\t\t<\/p>\n
            \n
          1. Click the gear (<\/i><\/strong>) in the top-right corner and select Site permissions<\/strong>.
            \n            \"SPO<\/a><\/li>\n
          2. Click Advanced permissions settings<\/strong> towards the bottom of the Permissions sidebar that appears.
            \n            \"SPO<\/a><\/li>\n
          3. If you’ve previously created a group like in the instructions above, you’ll see it on the list of groups that loads now, along with the three default groups (unless previously deleted).\u00a0 Select the group you’d like to modify.
            \n            \"SPO<\/a><\/p>\n
              \n
            1. To add new users, click New<\/strong> or click the down arrow(<\/i><\/strong>) to the right and then Add Users<\/strong>.
              \n              \"SPO<\/a><\/li>\n
            2. To remove users, check the box (<\/i><\/strong>) to the left of their name(s), click Actions<\/strong>, and select Remove Users from Group<\/strong>.
              \n              \"SPO<\/a><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n
              \n    \t\t\tMember of Multiple Groups<\/span>    \t\t\t    \t\t\t\t<\/p>\n
              \n    \t\t\t\t\tIt is possible to be a member of more than one group. You should always check the other groups when removing Users, especially former employees.    \t\t\t\t<\/p>\n<\/p><\/div>\n

              \n    \t\t<\/p>\n    \t\t\t\t<\/div>\r\n    \t\t\t<\/div>\r\n    \t\t<\/div>\r\n    \t\t\n    \t\t
              \r\n    \t\t\t
              Change Group Permission Level<\/h3><\/div>\r\n    \t\t\t
              \r\n    \t\t\t\t
              \r\n    \t\t\t\t\t<\/p>\n
                \n
              1. Click the gear (<\/i><\/strong>) in the top-right corner and select Site permissions<\/strong>.
                \n\"SPO<\/a><\/li>\n
              2. Click Advanced permissions settings<\/strong> towards the bottom of the Permissions sidebar that appears.
                \n                \"SPO<\/a><\/li>\n
              3. Check the box (<\/i><\/strong>) to the left of the group you’d like to modify and click Edit User Permissions<\/strong>.
                \n                \"SPO<\/a><\/li>\n
              4. Uncheck any obsolete options, check the box to the left of the appropriate permission level for this group, and click OK<\/strong>.
                \n                \"SPO<\/a><\/li>\n<\/ol>\n
                \n    \t\t\t\t<\/div>\r\n    \t\t\t<\/div>\r\n    \t\t<\/div>\r\n    \t\t\n    \t\t
                \r\n    \t\t\t
                Grant External Access<\/h3><\/div>\r\n    \t\t\t
                \r\n    \t\t\t\t
                \r\n    \t\t\t\t\t<\/p>\n
                \n    \t\t\tSponsored Guest Account Requirement<\/span>    \t\t\t    \t\t\t\t<\/p>\n
                \n    \t\t\t\t\tUnlike SharePoint 2016, SharePoint Online no longer requires the creation of a sponsored guest account to grant access to external users.    \t\t\t\t<\/p>\n<\/p><\/div>\n
                \n    \t\t<\/p>\n
                Granting External Access works the same as adding any other User to your SharePoint Site.\u00a0 See the Add Member or Owner<\/a>, Add Visitor<\/a>, or Grant Access to a Single File or Folder<\/a> sections.<\/p>\n
                \n    \t\t\t\t<\/div>\r\n    \t\t\t<\/div>\r\n    \t\t<\/div>\r\n    \t\t\n
                Single File or Folder Permissions<\/h2>\n
                Permissions in SharePoint are inherited; by default, any user granted permissions to your site will have access to every file and folder on that site.<\/p>\n
                If you require more granular permission management options, this section will instruct on how to grant access to or restrict access for specific files or folders.<\/p>\n
                The first step to individually managing a given file or folder\u2019s permissions is to stop inheriting permissions.<\/p>\n    \t\t
                \r\n    \t\t\t
                Disable Permission Inheritance<\/h3><\/div>\r\n    \t\t\t
                \r\n    \t\t\t\t
                \r\n    \t\t\t\t\t<\/p>\n
                  \n
                1. Click the ellipsis (<\/i><\/strong>) next to the file or folder for which you want to disable permission inheritance and select Manage Access<\/strong>.
                  \n                  \"SPO<\/a><\/li>\n
                2. Click the ellipsis (<\/i><\/strong>) in the top-right corner of the Manage Access window, and select Advanced settings<\/strong>.
                  \n                  \"SPO<\/a><\/li>\n
                3. Click Stop Inheriting Permissions<\/strong>.
                  \n                  \"SPO<\/a><\/li>\n
                4. Click Home<\/strong> from the sidebar below to return to your SharePoint site’s homepage.
                  \n                  \"SPO<\/a><\/li>\n<\/ol>\n
                  \n    \t\t\t\t<\/div>\r\n    \t\t\t<\/div>\r\n    \t\t<\/div>\r\n    \t\t\n    \t\t
                  \r\n    \t\t\t
                  Enable Permission Inheritance<\/h3><\/div>\r\n    \t\t\t
                  \r\n    \t\t\t\t
                  \r\n    \t\t\t\t\t<\/p>\n
                  \n
                  \n    \t\t\t\t\tIf you previously granted access to this file or folder while permission inheritance was disabled, this process will remove that access and revert to the default permission site settings.\u00a0     \t\t\t\t<\/p>\n<\/p><\/div>\n
                  \n    \t\t<\/p>\n
                    \n
                  1. Hover over and click the ellipsis (<\/i><\/strong>) next to the file or folder for which you want to enable permission inheritance, and select Manage access<\/strong>.
                    \n\"SPO<\/a><\/li>\n
                  2. Click the ellipsis (<\/i><\/strong>) in the top-right corner of the Manage Access window, and select Advanced settings<\/strong>.
                    \n                    \"SPO<\/a><\/li>\n
                  3. You will now be brought to the permissions page for your chosen file or folder. Click\u00a0Delete Unique Permissions<\/strong> and proceed through the prompt.
                    \n                    \"SPO<\/a><\/li>\n
                  4. Click Home<\/strong> from the sidebar below to return to your SharePoint site’s homepage.
                    \n                    \"SPO<\/a><\/li>\n<\/ol>\n
                    \n    \t\t\t\t<\/div>\r\n    \t\t\t<\/div>\r\n    \t\t<\/div>\r\n    \t\t\n    \t\t
                    \r\n    \t\t\t
                    Grant Access to a Single File or Folder<\/h3><\/div>\r\n    \t\t\t
                    \r\n    \t\t\t\t
                    \r\n    \t\t\t\t\t<\/p>\n
                    \n
                    \n    \t\t\t\t\tYou must disable permission inheritance before granting a user access to a single file or folder. Otherwise, you will grant site-access in addition to folder or file access.     \t\t\t\t<\/p>\n<\/p><\/div>\n
                    \n    \t\t<\/p>\n
                      \n
                    1. Click hover over and click the Share icon (<\/i><\/strong>) to the right of the folder to which you want to grant permissions.
                      \n\"SPO<\/a><\/li>\n
                    2. Enter any number of email addresses into the Add a name<\/strong> field, selecting their accounts from the search results as they appear.
                      \n                      \"SPO<\/a><\/li>\n
                    3. Expand the <\/i><\/strong>\/<\/i><\/strong>\/<\/i><\/strong> drop-down menu to the right and choose the level of access those accounts need.
                      \n                      \"SPO<\/a><\/li>\n
                    4. Add an optional message to appear in the email to the new members, and click <\/i>Send<\/strong>.
                      \n                      \"SPO<\/a><\/li>\n
                    5. Repeat steps 1-5 for any accounts that need a different level of access.<\/li>\n<\/ol>\n
                      \n    \t\t\t\t<\/div>\r\n    \t\t\t<\/div>\r\n    \t\t<\/div>\r\n    \t\t\n    \t\t
                      \r\n    \t\t\t
                      Restrict Access to a Specific File or Folder<\/h3><\/div>\r\n    \t\t\t
                      \r\n    \t\t\t\t
                      \r\n    \t\t\t\t\t<\/p>\n
                      \n
                      \n    \t\t\t\t\tYou must disable permission inheritance to enable the ability to restrict a user’s access to a file or folder.     \t\t\t\t<\/p>\n<\/p><\/div>\n
                      \n    \t\t<\/p>\n
                        \n
                      1. Hover over and click the ellipsis (<\/i><\/strong>) next to the file or folder for which you want to disable permission inheritance, and select Manage access<\/strong>.
                        \n\"SPO<\/a><\/li>\n
                      2. Click the ellipsis (<\/i><\/strong>) in the top-right corner of the Manage Access window, and select Advanced settings<\/strong>.
                        \n                        \"SPO<\/a><\/li>\n
                      3. Check the box(es) (<\/i><\/strong>) to the left to any account(s) whose access to this file or folder should be removed, and click Remove User Permissions<\/strong>.
                        \n                        \"SPO<\/a><\/li>\n<\/ol>\n
                        \n    \t\t\t\t<\/div>\r\n    \t\t\t<\/div>\r\n    \t\t<\/div>\r\n    \t\t\n    \t\t
                        \r\n    \t\t\t
                        Anonymous Access<\/h3><\/div>\r\n    \t\t\t
                        \r\n    \t\t\t\t
                        \r\n    \t\t\t\t\t<\/p>\n
                        See the dedicated Anonymous Access to Files and Folders<\/a> article for more details.<\/p>\n
                        \n    \t\t\t\t<\/div>\r\n    \t\t\t<\/div>\r\n    \t\t<\/div>\r\n    \t\t\n
                        Other<\/h2>\n    \t\t
                        \r\n    \t\t\t
                        Accept Access Requests<\/h3><\/div>\r\n    \t\t\t
                        \r\n    \t\t\t\t
                        \r\n    \t\t\t\t\t<\/p>\n
                        \n    \t\t\tDirect Link<\/span>    \t\t\t    \t\t\t\t<\/p>\n
                        \n    \t\t\t\t\tThe Access Requests page can be accessed directly using this link instead, replacing “MySite” with the name of your SharePoint Online Site.<\/p>\n
                        https:\/\/uvmoffice.sharepoint.com\/sites\/MySite\/Access%20Requests\/pendingreq.aspx    \t\t\t\t<\/p>\n<\/p><\/div>\n
                        \n    \t\t<\/p>\n
                          \n
                        1. Click the gear (<\/i><\/strong>) in the top-right corner, and select Site contents<\/strong>.
                          \n\"SPO<\/a><\/li>\n
                        2. Click <\/i>Site Settings<\/strong>.\"SPO<\/a><\/li>\n
                        3. Click Access requests and invitations<\/strong>.
                          \n                          \"APO<\/a><\/li>\n
                        4. You will be taken to the Access Requests page. Verify you recognize the person requesting access, then click\u00a0Approve<\/strong>.
                          \n                          \"Approve<\/a><\/li>\n
                        5. Select the appropriate permission level under the \u201cPermission\u201d section, then click\u00a0Approve<\/strong>.
                          \n                          \"Approve<\/a><\/li>\n<\/ol>\n
                          \n    \t\t\t\t<\/div>\r\n    \t\t\t<\/div>\r\n    \t\t<\/div>\r\n    \t\t\n    \t\t
                          \r\n    \t\t\t
                          Permission Levels<\/h3><\/div>\r\n    \t\t\t
                          \r\n    \t\t\t\t
                          \r\n    \t\t\t\t\t<\/p>\n
                          \n    \t\t\tDirect Link<\/span>    \t\t\t    \t\t\t\t<\/p>\n
                          \n    \t\t\t\t\tThe Permission Levels page can be accessed directly using this link instead, replacing “MySite” with the name of your SharePoint Online Site.<\/p>\n
                          https:\/\/uvmoffice.sharepoint.com\/sites\/MySite\/_layouts\/15\/role.aspx    \t\t\t\t<\/p>\n<\/p><\/div>\n
                          \n    \t\t<\/p>\n
                            \n
                          1. Click the gear (<\/i><\/strong>) in the top-right corner and select Site permissions<\/strong>.
                            \n\"SPO<\/a><\/li>\n
                          2. Click Advanced permissions settings<\/strong> towards the bottom of the Permissions sidebar that appears.
                            \n                            \"SPO<\/a><\/li>\n
                          3. Click <\/i>Permissions Levels<\/strong>.
                            \n                            \"Permissions<\/a><\/li>\n
                          4. From here you can view the Description<\/strong> of all Permission Levels for your Site, as well as Delete<\/strong> or Add<\/strong> custom Permissions Levels.<\/li>\n
                          5. To assign a permission level to a group of users, see https:\/\/www.uvm.edu\/it\/kb\/?post_type=ht_kb&p=28934&preview=true#change-group-permission-level above.<\/li>\n<\/ol>\n
                            \n    \t\t\t\t<\/div>\r\n    \t\t\t<\/div>\r\n    \t\t<\/div>\r\n    \t\t\n    \t\t
                            \r\n    \t\t\t
                            Additional Info<\/h3><\/div>\r\n    \t\t\t
                            \r\n    \t\t\t\t
                            \r\n    \t\t\t\t\t<\/p>\n
                            See UVM’s complete list of SharePoint documentation here<\/a>, or Microsoft’s SharePoint help & learning page here<\/a>.
                            \n<\/span><\/p>\n
                            \n    \t\t\t\t<\/div>\r\n    \t\t\t<\/div>\r\n    \t\t<\/div>\r\n    \t\t\n
                             <\/p>\n","protected":false},"excerpt":{"rendered":"
                            Permissions management ensures team members have access to the Sites and the files they need, and ensures former team members no longer have access to data they don’t. This page describes the process. Site-wide Permissions There are three default permissions groups that control access to a SharePoint Site: Visitors, who…<\/p>\n","protected":false},"author":156,"comment_status":"closed","ping_status":"closed","template":"","format":"standard","meta":{"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","footnotes":""},"ht-kb-category":[],"ht-kb-tag":[519,499],"class_list":["post-28934","ht_kb","type-ht_kb","status-publish","format-standard","hentry","ht_kb_tag-microsoft","ht_kb_tag-microsoft-sharepoint"],"_links":{"self":[{"href":"https:\/\/www.uvm.edu\/it\/dev\/kb\/wp-json\/wp\/v2\/ht-kb\/28934","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.uvm.edu\/it\/dev\/kb\/wp-json\/wp\/v2\/ht-kb"}],"about":[{"href":"https:\/\/www.uvm.edu\/it\/dev\/kb\/wp-json\/wp\/v2\/types\/ht_kb"}],"author":[{"embeddable":true,"href":"https:\/\/www.uvm.edu\/it\/dev\/kb\/wp-json\/wp\/v2\/users\/156"}],"replies":[{"embeddable":true,"href":"https:\/\/www.uvm.edu\/it\/dev\/kb\/wp-json\/wp\/v2\/comments?post=28934"}],"version-history":[{"count":36,"href":"https:\/\/www.uvm.edu\/it\/dev\/kb\/wp-json\/wp\/v2\/ht-kb\/28934\/revisions"}],"predecessor-version":[{"id":29021,"href":"https:\/\/www.uvm.edu\/it\/dev\/kb\/wp-json\/wp\/v2\/ht-kb\/28934\/revisions\/29021"}],"wp:attachment":[{"href":"https:\/\/www.uvm.edu\/it\/dev\/kb\/wp-json\/wp\/v2\/media?parent=28934"}],"wp:term":[{"taxonomy":"ht_kb_category","embeddable":true,"href":"https:\/\/www.uvm.edu\/it\/dev\/kb\/wp-json\/wp\/v2\/ht-kb-category?post=28934"},{"taxonomy":"ht_kb_tag","embeddable":true,"href":"https:\/\/www.uvm.edu\/it\/dev\/kb\/wp-json\/wp\/v2\/ht-kb-tag?post=28934"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}