SharePoint Online
OneDrive for Business
Permissions & inheritance
Document libraries
External sharing controls
SharePoint and OneDrive are where Lakeview Logistics's content lives — documents, financial records, operational files, HR data. Week 4 builds the full content collaboration infrastructure: department sites with correct permissions, a sensitive library protected with broken inheritance, OneDrive sync and Known Folder Move policy, and external sharing controls that allow collaboration without exposing internal data. The sites built this week persist through Weeks 5–8 and are the targets of DLP policies, sensitivity labels, and eDiscovery in later weeks.
SharePoint sites built in Lab 4-A
Lakeview Logistics Intranet
Communication site · All-staff hub
Owner: Sarah Chen
Members: LL-AllStaff
Home page, announcements, links
Finance
Team site · Restricted access
Owner: Priya Nair
Members: LL-Finance
Payroll Records library — broken inheritance
Operations
Team site
Owner: Marcus Webb
Members: LL-Operations
Fleet schedules, logistics docs
Sales
Team site
Owner: Kevin Park
Members: LL-Sales
Client files — external sharing enabled
HR
Team site · Most restricted
Owner: Diane Rousseau
Members: Diane + Sarah only
No external sharing
Daily breakdown
Day 1
Lecture: SharePoint architecture — sites, libraries, lists, pages; communication vs team sites; site templates
Lab 4-A: Create all five department sites with correct owners, members, and site templates → configure home page on each → create document libraries → set site-level sharing policies in SharePoint admin centre
Day 2
Lecture: Permission levels (Owner/Member/Visitor), inheritance model, breaking inheritance, Check Permissions tool, sharing links vs direct permissions
Lab 4-B: Configure Finance site permissions → create Payroll Records library → break inheritance → set unique permissions (Priya + Sarah only) → verify with Check Permissions → configure sharing link types per site → test access as non-Finance user
Day 3
Lecture: OneDrive architecture, sync client, Known Folder Move (KFM), org-wide sharing settings, external sharing tiers
Lab 4-C: Explore OneDrive for each user → configure org-wide OneDrive sharing settings in SharePoint admin centre → design KFM Group Policy settings (deployed via Intune in Week 6) → configure external sharing at tenant and site level → test sharing a file externally from the Sales site
Day 4
Lecture: Versioning, content types, column metadata, retention labels in SharePoint, hub sites
Lab 4-D: Enable versioning on Finance library → test version history → create content type with metadata columns → configure hub site association → explore SharePoint admin centre reporting → Bonus B: design KFM GPO settings for Week 6 deployment
Day 5
Review: permissions model, sharing controls, versioning, OneDrive — open Q&A
Assessment: permissions misconfiguration scenario — diagnose incorrect access, remediate it, verify with Check Permissions, configure an appropriate external sharing policy for a described business requirement, justify decisions in writing
Key concepts introduced this week
| Concept | What it is | Why it matters for the rest of the course |
|---|
| SharePoint permission levels | Three default levels: Owner (Full Control), Member (Edit — add/edit/delete content), Visitor (Read only). Custom levels can be created. Assigned via SharePoint groups or directly to Entra security groups. | The LL-Finance security group is assigned Member access to the Finance site. When DLP policies target the Finance site in Week 7, these group-based permissions determine who has access to the content being protected. |
| Permissions inheritance | By default, every library, folder, and item inherits permissions from its parent site. Breaking inheritance at a library or folder creates a unique permission set disconnected from the parent — future site-level changes don't propagate to the broken object. | The Payroll Records library with broken inheritance is the target of the Week 8 eDiscovery legal hold (Lab 8-B) — demonstrating how unique permissions and legal holds interact to protect sensitive content. |
| External sharing tiers | Four levels at tenant and site level: Anyone (anonymous links), New and existing guests (requires authentication), Existing guests only, Only people in your organisation. Site-level setting cannot be more permissive than tenant-level setting. | The Sales site with external sharing enabled is the origin of the Payroll-Q4.docx sharing incident in the Week 7 assessment — demonstrating the risk of misconfigured sharing controls and the forensic trail it creates in the audit log. |
| OneDrive for Business | Each M365 user gets a personal OneDrive — 1 TB by default. Functions like a private SharePoint site. Sync client (OneDrive app) mirrors content to local device. KFM automatically redirects Desktop, Documents, and Pictures to OneDrive. | KFM designed in Lab 4-C Bonus B is deployed via Intune in Week 6 Lab 6-C. This is a deliberate two-week connection — students design the policy in Week 4 and operationally deploy it in Week 6. |
| Versioning | SharePoint stores previous versions of every document. Major versions (visible to all) and minor versions (draft, visible to editors only). Version history allows restore to any previous state. | Version history is the last line of defence if a document is accidentally overwritten. In Week 8's compliance discussion, version history combined with retention policies provides a complete data protection story. |
| Hub sites | A hub site is a SharePoint site that acts as a navigation and search hub for associated sites. Associating department sites to the Intranet hub creates consistent navigation and unified search across all content. | The hub site structure built in Lab 4-D is referenced in Week 5 Teams admin discussions — Teams channels link to SharePoint libraries, and hub search makes content discoverable across the org from Teams. |
Finance site permission design — the most security-sensitive site
| Location | Who has access | Permission level | Inheritance status |
|---|
| Finance site (root) | Priya Nair, LL-Finance, Sarah Chen | Priya: Owner · LL-Finance: Member · Sarah: Owner | Inherited from tenant defaults (not broken) |
| General Documents library | Same as site | Inherits site permissions | Inheriting |
| Payroll Records library | Priya Nair, Sarah Chen only | Priya: Owner · Sarah: Member | Inheritance broken — unique permissions |
| HR site (separate site) | Diane Rousseau, Sarah Chen only | Diane: Owner · Sarah: Member | Separate site — no shared permissions with Finance |
External sharing configuration — per site
| Site | External sharing setting | Business rationale |
|---|
| Tenant level (default) | New and existing guests | Baseline — requires authentication for all external access; anonymous links disabled at tenant level |
| Intranet (Communication site) | Only people in your organisation | Internal company news and announcements should never be visible outside the organisation |
| Finance site | Only people in your organisation | Financial data must not be shared externally without explicit approval — strongest restriction |
| Operations site | Only people in your organisation | Fleet and logistics operational data is internal only |
| Sales site | New and existing guests | Sales needs to collaborate with clients and external partners — external sharing enabled with authentication required |
| HR site | Only people in your organisation | HR data (contracts, performance reviews) is the most sensitive — no external sharing under any circumstances |
Week 4 connections to other weeks
| Week 4 element | Connected to | How |
|---|
| Finance SharePoint site + Payroll Records library | Week 7 Lab 7-D (DLP), Week 8 Lab 8-B (eDiscovery) | The Finance site is a priority content location in the DLP policy (W7) and the eDiscovery legal hold target for Priya Nair's mailbox and the Finance site (W8). The Payroll-Q4.docx file shared in the W7 incident is stored in this site. |
| Sales site external sharing enabled | Week 7 assessment, Week 8 Lab 8-C audit log | The Week 7 assessment scenario involves Payroll-Q4.docx being shared externally from the Finance site (misconfiguration). The audit log investigation in W8 Lab 8-C finds the AnonymousLinkCreated or SharingInvitationCreated event on this site. |
| KFM design (Lab 4-D Bonus B) | Week 6 Lab 6-C | Students design the KFM Group Policy settings (Desktop, Documents, Pictures redirect to OneDrive) in Week 4. In Week 6 they deploy those exact settings as an Intune configuration profile. The two-week gap is intentional. |
| OneDrive org-wide sharing settings | Week 7 Lab 7-D (DLP endpoint) | OneDrive is one of the five workloads in the DLP policy. The sharing settings configured here determine what DLP needs to protect — content being shared via OneDrive links is monitored by the DLP policy. |
| Hub site structure | Week 5 Teams admin | Teams channels are backed by SharePoint document libraries. The hub site navigation makes SharePoint content discoverable from Teams search. Students connecting their Teams teams to SharePoint channels in Week 5 build on the hub structure from Week 4. |
Primary admin centres this week
| Portal | URL | Used for |
|---|
| SharePoint admin centre | admin.microsoft.com/sharepoint | Creating sites, configuring tenant-level sharing settings, managing storage, setting site-level sharing overrides, hub site management — primary admin centre for Week 4 |
| SharePoint site settings | Each site → Site settings (gear icon) | Site permissions, permission inheritance, Check Permissions tool, site collection features — operated at the individual site level rather than the admin centre |
| OneDrive admin centre | admin.microsoft.com → OneDrive | Org-wide OneDrive sharing settings, storage quotas, sync client settings, KFM policy configuration |
Key design decisions for Week 4
Broken inheritance on Payroll Records is the single most important permissions concept of the week. The Payroll Records library is the course's canonical example of why inheritance exists, when to break it, and what the risk is if you don't. Students who create the library, break inheritance, set unique permissions, and verify with Check Permissions — then try to access it as Tom Bellamy (LL-Finance member, but not granted unique access) — understand permissions viscerally rather than theoretically.
The Sales site external sharing setting enables the Week 7 incident. External sharing is deliberately enabled on the Sales site (realistic — sales teams do need to share with clients). The Week 7 assessment scenario exploits this: Payroll-Q4.docx gets accidentally shared externally because an employee used the wrong site. Students who set the external sharing correctly in Week 4 understand in Week 7 exactly why the Finance site's more restrictive setting would have prevented the incident if the file had been in the right place.
KFM is designed in Week 4 and deployed in Week 6 — this is deliberate. Students who design the Group Policy settings for KFM in Week 4 Bonus B, then come back to them six weeks later and deploy them via Intune, experience one of the most realistic IT admin scenarios in the course: architecture and deployment as separate phases. When they deploy it in Week 6, they understand what it does and why they designed it the way they did.
Learning outcomes — by end of Week 4, students can…
Create SharePoint sitesProvision team and communication sites with correct owners, members, and templates
Configure permissionsSet site permissions using security groups and explain the three default permission levels
Break inheritanceBreak library-level inheritance and set unique permissions, verified with Check Permissions
Manage external sharingConfigure tenant and site-level external sharing settings appropriate to business requirements
Configure OneDriveSet org-wide OneDrive sharing settings and design a KFM policy for managed device deployment
Use versioningEnable versioning on a document library and restore a previous version
Explain the permissions modelDescribe how inheritance works and when breaking it is appropriate vs when it creates risk