How to set SharePoint Permissions – Complete Guide

Each SharePoint site comes with default groups and permissions. For most situations, they are perfectly fine, but sometimes you need to change those permissions. What are then your options to change, set, or add SharePoint permissions?

There are several options when it comes to managing permissions in SharePoint. We can set permissions for the whole site or group, on the document library level, and even at folder level.

In this article, I will explain how the default permissions work and what options you have to change the permissions in SharePoint Online.

Default Permissions in SharePoint

When you create a new SharePoint site you have, normally, two options to choose from, a Team site or a Communication site (SharePoint administrators have also other options to choose from). Depending on your choices the following users have permission to the SharePoint site:

	Team Site (private)	Team Site (public)	Communication site
Owners	Selected users	Selected users	Selected users
Members	Selected users	Everyone except external users	Everyone except external users
Visitors	–	–	–

Atleast one owner must be selected when you create the SharePoint site. In the case of a Team site, you can also add the member while creating the site. But in all cases, we can modify the owners, members, and visitors later.

So these are the default permissions, but what options do we have to change this?

Edit SharePoint Permissions

As mentioned at the beginning of the article we can set the permissions on different items in SharePoint. Starting all the way at the top, at the site level, to all the way down at folder level. Good to know is that permissions are by default inherited from the top down.

This means that if we change the permissions at a document library, the permissions in all folders below it are also changed. Now, this is expected behavior, but keep in mind that this also means that subsites also inherit the permissions from the main site.

Note

When your document library, list or folder contains more then 100,000 items, you can’t create unique permissions. The inheritance can’t be removed or recreated when you exceed the threshold.

SharePoint Permission Levels

SharePoint permissions levels are a set of permissions that you can assign to a user or group. There are 5 predefined sets in SharePoint Online, which are suitable for most use cases. It’s also possible to create your own permission levels allowing you to fully customize the permissions that you want to give.

So as mentioned, it’s possible to create your own permission levels. To do this, click on settings (gear icon) in the top right corner and select Site permissions > Advanced Permissions.

In the permissions tab, click on Permissions Levels:

All the existing permissions levels are listed here. It’s best practice to not change the existing permissions levels but instead add a new permissions level.

We can now select the permissions that we want to assign. As you will notice, when you select a permission, other options are automatically selected as well. For example, when we choose to Create Alert, then View Items, View Pages and Open are also selected. These extra permissions are needed so the user can access the site and view the libraries.

Site Permissions

The first place to change permissions for a SharePoint site is the site permissions. This will allow you to set the security setting at site level, affecting all document libraries, lists, pages, etc. Permissions should always be set with the Principal of least privileges in mind. Don’t give users more permissions than they need.

To change the site permissions we will need to open the settings menu (gear icon) and click on Site Permissions:

This will show the basic permissions and allows you to add members and owners to the site. Click on Add members (1) to add users to the site. Here you can look up users and make them Members or Owners of the SharePoint site.

Another option is to use the Advanced Permissions Settings (2). The advanced settings allow you to choose custom permission levels and add groups of users (security groups) to the SharePoint site.

1. Click on Advanced Permissions Settings in the screenshot above (2)
2. Click Grant Permissions
3. Search for users or security groups. You can add multiple groups or users simoultancyly
4. Select Show Options
5. By default, the users will receive an invitation email. You can turn it off if you want
6. Select the permission level that you want to assign.
7. Click Share to grant the permissions.

Creating Custom Groups

By default, you can only add users or groups to the default security groups (owners, members, visitors). But it’s also possible to create your own security groups. Each group can be assigned one or multiple permission levels.

Click on Create Group in the Advanced Permissions settings:

Give the group a meaningful name and select who can view and add members to the group. At the end of the settings page we can choose the permission level that we want to assign to the group members, for example, Restricted view:

After you have created the group, we can go back to the permissions page and assign users to our newly created security group:

Document Library Permissions

When site-level permissions are not suitable for your situation, then the next level where we can set permissions is on the document library or lists in SharePoint. To change the permissions on a document library we first need to open the library:

1. Click on Settings (gear icon)
2. Choose Library Settings

3. Click on Permissions for this document library

We will now see the same permissions as we have set at site level. So the first step is to stop inheriting the permissions from the parent. This will copy all existing permissions to the document library, making them unique.

Note

Keep in mind that changes made at site level later are not applied to this document library after you stop inheriting. So users who are now member at site level, will remain member of the document library if you remove them later at site level

4. Click on Stop Inheriting Permissions and click Ok on the warning

We can now modify the permissions just as we did at site level. This means that we can add a custom security group, grant additional permissions to users or groups, or change the permission level of the existing groups.

For example, we can remove the members, visitors, and testers from the document library, so that only the owners of the SharePoint site can access the Budgets document library.

Folder Permissions

We can also create custom permissions at the folder level in SharePoint. Keep in mind that custom folder permissions are harder to keep track of, so make sure that you document them properly and don’t use them too much.

Here we have a couple of options, we can create a link that gives access to the folder (3), just like the normal sharing options. Or directly add a user to the folder (4). But it’s also possible to create unique permissions, just like with the document library. Click on Advanced (5) to view the permissions settings.

The advanced permissions work the same as the document library. First, stop inheriting the permissions and then create your own custom permissions for the folder.

File Permissions

In SharePoint, it’s even possible to add unique permissions to a file. Now just like folders, don’t use this too much. You will easily lose track of all the unique permissions. Setting file permissions works exactly the same as folder permissions in SharePoint.

1. Click on the 3 dots (Show actions) behind the file
2. Select Manage Access
3. Click on Advanced to create unique permissions

Refer to the steps above on how to stop inheriting the parent permissions and add unique security groups, users, and/or permission levels.

List Permissions

List permissions are a bit special compared to document libraries in SharePoint. They have the same permission structure, so you can give users or groups unique permissions to the list. But besides the list permissions, we can also set permission on item-level in SharePoint.

In the settings screen, we can open the permission for this list (3). Also note the Advanced Settings option, which we will use later for the item-level permissions.

We first need to stop inheriting the site-level permissions before we can add unique permissions to the list. After stopping the inheritance, you can add or remove user or security groups from the list. Refer to the steps above for more details about this.

Item-Level Permissions

A special feature of lists in SharePoint is that we can set permissions on item level. The permissions are limited to the question if a user can view and/or edit only their own items or all items. So we can give a user read-all access, which allows them to view all items on the list. But limit the create and edit permission to only the items created by the user.

To set the item permissions, click on Advanced Settings in the List settings. Here we can set the item-level permissions:

We can’t add custom permissions levels to the items, but these options should be more than sufficient in most cases.

Wrapping Up

I hope this article helped you with configuring your SharePoint permissions. Try to limit the unique permissions to site level and document library level only. When you start creating unique permissions on folder or file level, you can quickly lose the overview.

If you have any questions just drop a comment below.