Microsoft 365 / Set SharePoint site permissions and manage external sharing

SharePoint site permissions determine who can access the site, and external sharing settings limit the scope of sharing content with people outside the organization. If it is a site connected to a team, you should also check the relationship with Teams / Microsoft 365 group members. Site permissions and sharing links are not the same settings.

Structure to check before changing permissions

• Check whether the site is an independent site or a site connected to a Microsoft 365 group / Teams.
• Check the current access groups and directly granted permissions, such as owners, members, and visitors.
• Check if there are any separately created sharing links for files or folders.
• Check the organization-level SharePoint and OneDrive external sharing scope and Microsoft Entra guest invitation settings.

Microsoft’s guide to SharePoint sharing and permissions recommends managing group-connected site membership through the associated Microsoft 365 group, or through Teams when the site is connected to a team. Giving someone permission to the site alone does not automatically make them a member of the Teams team.

Owners, members, visitors and permission inheritance

In a typical site, owners handle management, members handle editing, and visitors handle viewing. However, if there are custom permissions on an existing site, do not determine actual permissions by name alone; check the settings. Group-connected team sites are linked to the owners and members of Microsoft 365 Groups, while communication sites are managed mainly around the site’s SharePoint groups.

Permission inheritance is a structure where libraries, folders and files follow the permissions of their parent. If different permissions are given to a single file or a separate sharing link is created, it becomes difficult to grasp all access only from the site list. When receiving a request to 'remove access for a specific employee,' you need to check all three paths together: team or site groups, direct permissions, and sharing links.

Private and shared channel sites in Teams are managed through channel members according to the Teams and SharePoint connection structure . Unlike regular sites, you should not try to independently change members in SharePoint. In addition, site administrators cannot change all policies, and changing the external sharing permission level of a site requires SharePoint administrator privileges.

Check and modify site permissions

1. Go to [Sites] → [Active sites] in the SharePoint admin center and search for the target site. Since there may be channel sites with similar names, check both the URL and the site type.

2. Check the relationship between administrators, owners, and members in the site details. If it is a Teams-connected site, first review the list of team owners and members.
3. Add or remove groups or users according to the purpose of the change. If you only want to share a specific file, do not grant access to the entire site and consider file sharing instead.
4. Use a test account to confirm that only the expected content is visible. If permissions have been expanded, check previous sharing links and direct permissions as well.

Example of adding someone to view only the site

Let's assume a case where another department only needs to read the document site. If there is no need to participate in Teams conversations or schedules, consider whether site read permission is appropriate instead of adding them as general members of the group. Microsoft 365 groups do not provide a read-only membership role, so a separate site-level Read grant may be appropriate for this requirement.

1. Open the target site and check the current groups and permissions at Settings → Site Permissions.
2. If it is a communication site, choose Share Site, and if it is a group-connected site, select the appropriate path such as Add Members → Share Site Only according to the purpose. Use the Teams member path if the intention is for full team participation.
3. Select the exact users/security groups and designate Read permission. Review the target and notification settings before adding. Microsoft Site Sharing Guide differentiates between sharing with group resources and sharing the site only.
4. Ask the intended user or an approved test user to verify that they can read the test document but cannot edit it. Do not infer their permissions solely from the administrator’s view.

If you want to show only one file, do not share the entire site. Instead, set the target and view/edit permissions on that specific file. The “People with existing access” link is used to send the access path they already have and is different from the link used to grant new permissions.

Set external sharing scope

You cannot share more broadly at the site level than what is allowed at the organization level. After checking the organization sharing settings in the SharePoint admin center, select the required level in the target site's [Settings] → [More sharing settings]. Microsoft’s Guide to site-specific external sharing explains the relationship between organization-level settings and site-specific settings.

Allowing the Anyone level does not make the site itself anonymously public. It lets people with the required sharing permissions create unauthenticated links to eligible files and folders; it does not give every person permission to create links. A holder can forward such a link to someone else. If the work is limited to named partners, consider an authenticated Specific people link instead. Some locations, including shared-channel files, do not support Anyone links.

1. In the SharePoint admin center, check the organization's maximum scope in Policies → Sharing . If only one site is needed for this task, first review whether it is necessary to extend to the organization-wide setting.
2. Sites → Active sites, select the site by its actual URL, and go to Settings → More sharing settings.
3. Check the permission level, domain restrictions, guest expiration, and default link type. The available options are affected by organizational settings and other external collaboration policies.
4. Record the previous values, save only the required changes, and read the settings back. Use a non-sensitive test file and approved test accounts to check the intended access. Test an intended external recipient and an excluded account that has no separate access grant. A Specific people link should not grant a forwarded recipient new access; an Anyone link can be usable by another holder without signing in. Compare the result with the selected link type and current policies.

Stop sharing and investigate access errors

If there are no external sharing options, check the organization restrictions, site type, Entra guest invitation and domain restrictions, and group policies in order. If the invitation succeeded but the file cannot be opened, verify whether the recipient authenticated with the invited address and check the actual file storage. Enabling one allowed setting on a site does not override all other policies.

When revoking access, clean up unnecessary links and direct permissions in the file’s Manage access panel, and if access is through a group, modify the group members as well. Even if one link is deleted, members with site permission can still access it. Removing these SharePoint grants does not delete copies that have already been downloaded.

If you narrow the settings, existing external links may not work. However, if you re-enable sharing at the organization level, previous site settings and shared links may start working again, so do not confuse temporary blocking with permanent link deletion. If you accidentally broadened the scope, in addition to restoring the previous policy, you should also check the links and invitations that were created during that time. Microsoft notes that guests typically lose access within an hour after external sharing is restricted or disabled; do not assume every change is instantaneous. Its organization-level sharing guidance also explains restored guest access after sharing is re-enabled. Complete the check by confirming the actual results with both permitted and excluded test accounts.