How SharePoint Permissions work (Best Practices)

Рет қаралды 11,215

Күн бұрын

Пікірлер: 37

@SharePointMaven 6 ай бұрын

👉 If you want to learn more on this topic, check out this video as well: kzbin.info/www/bejne/iabQl3asqdGMjassi=rXrVJVPSoTHn_65h

@travelwithmegabe 10 күн бұрын

Thank you for making this video. I was pulling my hair trying to understand how to work on the permissions/what people can do and see.

@SharePointMaven 10 күн бұрын

My pleasure - happy to hear it helped!

@TrotterSoccer 17 күн бұрын

Very nice video. Wish u the best for sharing all this - much easier than to read through Microsoft docs. Thanks!

@SharePointMaven 16 күн бұрын

Thank you, for the kind words!

@rafagarcia5548 28 күн бұрын

Another great video. Thanks Greg! A related question. In very large companies they use tools like ShareGate or AdminDroid to help administrators design permission policy. Which people should belong to which groups and which sites / libraries / folders should be given access to. I use an Excel template that I have refined over time. But I miss something more professional than an Excel, but not as complex and expensive as those other tools. Something within the reach of small and medium sized organisations. Any proposals? Thank you very much in advance

@SharePointMaven 27 күн бұрын

Thank you. Honestly not aware of any middle tier between Excel and formal governance tools. Perhaps you can also build a list in SharePoint, but that's about it.

@BizzleNJ 27 күн бұрын

Thanks for the video. You mention in the first point that permissions should be managed at the site level. Later on you mention sharing individual files and folders. In a org where one department needs to collaborate with several others this can result in dozens or hundreds of sites. How do you recommend balancing these requirements against the site level permission best practices?

@SharePointMaven 27 күн бұрын

If you have dedicated collaboration channels among departments that need to collaborate on an ongoing basis - its own site makes sense. There is nothing wrong with many sites as long as they are being used. For ad-hoc file/folder sharing - users can share individual files/folders as needed.

@BizzleNJ 27 күн бұрын

@SharePointMaven Ah thanks for the insight. Do you know of any tools or reports that can be used to keep an eye out for excessive ad-hoc sharing?

@SharePointMaven 27 күн бұрын

@@BizzleNJ Yes, ShareGate and Orchestry both have governance tools for this purpose.

@davidadams421 Ай бұрын

Fantastic video - great content, well structured and professionally delivered. You have a new subscriber! I would love to see this video updated, or perhaps an extension, to also incorporate Teams-based permissions and how they interact with SharePoint. And when I say Teams, I also include Teams settings and Private/Shared channel SharePoint sites.

@SharePointMaven Ай бұрын

Thanks for the kind words and for subscribing to my channel. I do explain this subject in here: kzbin.info/www/bejne/iXzKY62qh6yYg80si=Cb0Yr4TojnBb1m1w

@IrlymMylros 6 ай бұрын

Thank you for this excellent video. Very informative.

@SharePointMaven 6 ай бұрын

You are welcome, happy to hear you found it useful

@austinmorris8272 4 ай бұрын

You mentioned that nobody should create custom permission levels, but how else do you prevent deletion of critical folders or files, either intentionally or unintentionally? What if you want to allow modification and adding of new files, but not deletion?

@SharePointMaven 4 ай бұрын

This was a general advice, but if you must absolutely have such permission level - you can create it. The problem with it is that it is local to a Site and if you need such custom permissions on many sites - they need to be set up manually on all sites. There are also ways to allow for file deletion but set up alerts or even retention policies. But again, if that is the requirement - then it is what it is.

@ukm365 6 ай бұрын

Great tips for folks new tosite ownership or just making their way in administering a SharePoint Online instance.

@ukm365 6 ай бұрын

I would add, though ... that I *think* I'm able to add groups as members of Teams / Teams sites Sharepoint Groups. I say this because my oft repeated adage is the only tip that I would add, here ... next! 🙂 ( _just so that it's buried and doesn't look like I'm critiquing you ... because I'm totally not!!!_ :-) ... )

@ukm365 6 ай бұрын

I would say that wherever it is possible, place 365 groups inside SharePoint groups. This then puts the access squarely in the hands of your IT / IT Admin/Security team to manage access requests. They already have a business process for handling user access requests, and placing this in their hands is a salient choice all around. Managing SharePoint groups in 2024 should not be someone's job, and at best it should be the odd admin having to give themselves access to something.

@ukm365 6 ай бұрын

Remember, too, that it's entirely possible to create low-level M365 Security groups, and you could even set-up an automation to sort this all out. When someone makes a new communications site, let's call it " _financeforms_ " ( _later renamed to " _*_Finance Forms_* " and it's there just to fulfull a very obvious purpose. You can have a subscription monitoring for new sites, and that will create 3 `sp_financeforms` groups like so: - `sp_financeforms_owners` - `sp_financeforms_members` - `sp_financeforms_visitors` This might all seem like duplication, but managing M365 groups and their members is second nature for an IT team, or the person who's been assigned that work. Plus, you can often get away with just having a members and visitors group for most functions. The IT team certainly *won't* want to be managing SharePoint groups in addition to resources that already exist, plus the ' _SP Finance Forms Owners_ ' group will then be the group that is asked for authorisation to add additional staff to a team, anyway. 👍 But, yes, leaning into adding individual users to sites will always immediately create a job that someone will need to keep an eye on those memberships.

@ukm365 6 ай бұрын

I like to try to think functionally with my groups, so that if I'm working with a business process, then I will have a Teams team that owns the process. So, here, there will be a Finance Teams team, and the *Members* of that teams team will in the be SharePoint Owners group of the Communications site. They'll also be in the SharePoint Members group ( _because SP can be fickle sometimes_ ), then that enables the whole team to manage the process adequately.

@SharePointMaven 6 ай бұрын

Thank you!

@matze1968244 3 ай бұрын

We have the AD Security Group, plus the Microsoft 365 Group, both explained in the video. On top there are also SharePoint Groups at the site level. Could the later not also be well used for access to a specific folder on a site?

@SharePointMaven 3 ай бұрын

Yes, they can