SharePoint site permissions: owners, members and visitors

The three groups in practice

Owners can change the site's settings, add or remove people, create libraries and restore deleted items. Each site should have at least two owners, so one person's leave or departure does not leave the site unmanaged, and they should be people who understand what the site is for, usually the manager of the team that uses it.

Members can create, edit and delete content. Most staff who work with a site's documents are members. Visitors can open and download files but not change them, which suits reference material such as policies, templates and price lists that only a few people maintain. Thinking in these three roles covers most of what a small business needs.

Team sites and Microsoft 365 groups

Sites created from Microsoft Teams, or as modern team sites, are connected to a Microsoft 365 group. The group's owners become the site's owners and the group's members become its members. Adding someone to the team in Teams therefore gives them member access to the files automatically, and removing them takes it away.

This is convenient, but it means site access is managed in two places: in Teams or the group, and in SharePoint for visitors or extra permissions. Pick one place as the main way you manage access for each site and stick to it. Mixing them leads to people being removed from a team but still having access to its files through a SharePoint permission someone added separately.

Use groups, not individuals

Granting access to individuals one by one works for a five-person office and becomes unmanageable soon after. Create groups that reflect roles, such as Finance, Managers or Project Team, and grant access to the group. When someone joins or changes role, you change their group membership once, and every site that uses the group follows.

Security groups or Microsoft 365 groups both work. Some businesses use dynamic groups that update automatically from staff details, such as department, though this needs accurate information in the user profiles and suitable licensing. Even manually managed groups are far better than scattered individual permissions that nobody can audit. Name groups clearly, so that anyone reading a permissions page understands at a glance who is included and why.

Unique permissions and why to avoid them

SharePoint lets you break inheritance on a folder or file and give it different permissions from its library. It is occasionally necessary, but it creates hidden exceptions that are hard to track. Six months later someone cannot find a document they should see, or someone can see something they should not, and nobody remembers why.

If a set of documents needs different access, the cleaner answer is usually a separate library or site with its own permissions. When you do need unique permissions, document them in a simple list so they can be reviewed. SharePoint's site permissions page can show where inheritance has been broken, which helps when cleaning up an older site.

Reviewing access regularly

Access drifts as people change roles, projects end and contractors come and go. Ask each site owner to review membership every quarter or six months: who is an owner, who is a member, which guests have access and which sharing links exist. Microsoft 365 can send automated access reviews on some licences, but a calendar reminder and a short checklist work fine for a small business.

Pay extra attention to sites with sensitive information, sites with guest access and sites where the Everyone group has been added. Remove anyone who no longer needs access. A clean permissions model is also the foundation for Copilot readiness, data protection and simpler offboarding when people leave. Record the date of each review and what was removed, so there is a trail if a client or insurer asks how access is controlled.

Common small-business mistakes

Typical problems include everyone being made an owner so they can add colleagues, sites with a single owner who left years ago, finance files on the company-wide site with a folder permission someone forgot about, and old project sites still open to former contractors. Each is easy to fix once spotted, and spotting them only takes a structured look.

Fix the worst first: sensitive sites with broad access, sites with no current owner and guests who should be gone. Then agree simple rules for new sites, such as two owners, groups instead of individuals, and no broken inheritance without a written reason. Those rules keep the clean-up from needing to be repeated next year.