0:00–0:10
Recap
0:10–0:40
Lecture
0:40–1:40
Guided Lab
1:40–1:50
Bonus
1:50–2:00
Debrief
Day 1 review & the permissions problem
- Ask: "The Finance Department site has Priya Nair as Owner and LL-Finance as Members. Tom Bellamy is in LL-Finance. What can Tom do on the Finance site right now?" — surface the default Member permission level
- Ask: "Priya creates a document library called 'Payroll Records' inside the Finance site. Who can access it?" — answer: everyone in LL-Finance, because permissions inherit from the site. This is the problem.
- Ask: "How would you give only Priya Nair and Sarah Chen access to Payroll Records while keeping other Finance members out?" — prime the answer: break inheritance and set unique permissions
- Frame the day: SharePoint's default inheritance means a misconfigured site-level permission automatically exposes everything underneath it. Understanding the model prevents accidental data exposure.
The SharePoint permissions model — levels, inheritance, and sharing
SharePoint has a layered permissions model that most admins partially understand. Today's lecture covers it completely — permission levels, inheritance, and sharing links — because all three interact in ways that create unintended access if any one is misunderstood.
The three default permission levels
| Level | Default group | What they can do | Cannot do |
|---|
| Owner (Full Control) | [Site] Owners | Everything — manage permissions, delete site, add members, change settings | N/A |
| Member (Edit) | [Site] Members | Add, edit, delete content — documents, list items, pages | Change permissions, add members, access Site Settings |
| Visitor (Read) | [Site] Visitors | Read and download content only | Create, edit, or delete anything |
- Permissions inheritance — by default, every library, folder, and item inherits permissions from its parent site. If a user has Member access to the site, they have Member access to every library, folder, and document in it — unless inheritance is broken at a specific level.
- Breaking inheritance — creates a unique permission set disconnected from the parent. Existing inherited permissions are copied as a starting point. Future changes to the parent do NOT propagate down to the broken object. Break at library or folder level — never at individual document level if avoidable.
- The Check Permissions tool — Site settings → Site permissions → Check permissions. Enter a user's name to see exactly what access they have and why. First tool to use when investigating any permissions complaint.
Sharing links vs direct permissions
| Mechanism | How it works | Auditable? | Revocable? | Best for |
|---|
| Sharing links | A URL is generated. Anyone with the link (or specific people) can access the item — no group membership needed | Yes — usage reports and audit logs | Yes — delete the link | One-off sharing with specific people or external users |
| Direct permissions | A user or group is added to a SharePoint group or unique permission list | Yes — permissions panel | Yes — remove from group | Ongoing access managed with groups |
- Least privilege design — use security groups (not individuals) to grant site access; grant the minimum permission level needed; break inheritance only where genuinely needed; review permissions regularly. Never grant Full Control to non-administrators.
Instructor note: The inheritance demo is the most effective teaching moment of the week. Open the Finance site on the projector — show the site permissions. Create a library. Show it automatically inherits site permissions. Then break inheritance — watch the UI change. This 5-minute live demo makes the abstract concept concrete before students touch it themselves.
Lab 4-B: Configuring permissions and breaking inheritance for Lakeview Logistics
Students configure site permissions using groups, create a sensitive document library with broken inheritance, test permissions using Check Permissions, configure sharing links, and audit via PowerShell.
- Step 1 — Review and configure site permissions (10 min)
Finance site → Site settings → Advanced permission settings. Add LL-AllStaff as Visitors. Verify: Priya Nair = Owner, LL-Finance = Members, LL-AllStaff = Visitors. Record before/after states.
- Step 2 — Create Payroll Records library with broken inheritance (20 min)
Create document library "Payroll Records" on the Finance site. Break inheritance. Remove LL-Finance Members and LL-AllStaff Visitors. Add Priya Nair (Full Control), Sarah Chen (Read). Keep Finance Site Owners (Full Control).
- Step 3 — Verify with Check Permissions (10 min)
Run Check Permissions for: Tom Bellamy, Priya Nair, Sarah Chen, Marcus Webb — at both the Finance site level and the Payroll Records library level. Document the different results and explain why they differ.
- Step 4 — Create and test a sharing link (10 min)
Upload a sample document to Payroll Records. Create a Specific People sharing link for Marcus Webb with View permission and 7-day expiry. Record whether Marcus can access it despite having no library permissions.
- Step 5 — Audit via PowerShell (10 min)
Get-SPOSiteGroup -Site https://[tenant].sharepoint.com/sites/Finance | Select-Object Title, Users | Format-List
Record the output. Note that library-level broken inheritance does NOT appear in this output — document this limitation.
Inheritance warning: Once you break inheritance on Payroll Records, changes to the Finance site's permission groups will no longer affect the library. Adding a new Finance member to LL-Finance will NOT automatically grant or deny them access to this library. Managing broken inheritance requires active, ongoing attention.
⭐ Bonus: Custom permission levels & access request settings
⭐ Bonus A — Create a custom permission level
- Finance site → Site permissions → Permission Levels → Add a Permission Level
- Create "Finance Contributor" — check View Items, Add Items, Edit Items, Delete Items (own), View Versions. Do NOT check Manage Lists, Manage Permissions, or Delete Items (others)
- Apply Finance Contributor to Tom Bellamy directly (not via group) as a test
- Lab Journal: why create a custom level rather than using the default Edit (Member) level? What Lakeview Logistics scenario justifies it?
⭐ Bonus B — Access request settings
- Finance site → Site settings → Access Request Settings. Enable access requests. Set destination to Priya Nair's email.
- In InPrivate window as Marcus Webb, navigate to Payroll Records — get denied. Submit an access request.
- Sign in as Priya Nair — confirm the request arrives. Review but do not approve.
- Lab Journal: why is a managed access request process preferable to users emailing an admin?
Reflection & preview
- Ask: "A new Finance employee joins next month and is added to LL-Finance. What access do they have to the Payroll Records library, and what must an admin do?" — surface the ongoing management cost of broken inheritance
- Ask: "The Marcus Webb sharing link expires in 7 days. What exactly happens after expiry — does the file disappear or does he just lose link access?" — answer: the file remains, the link stops working, his underlying permissions determine whether he can reach it another way
- Ask: "Get-SPOSiteGroup didn't show Payroll Records library permissions. How would you audit who has access to that library?" — surface the gap: needs PnP PowerShell or the SharePoint UI
- Exit ticket: describe the exact steps and tools you'd use if a user reported "I can access the Finance site but cannot see the Payroll Records library"
- Preview Day 3: permissions control internal access. Day 3 covers external sharing — who from outside can access Lakeview Logistics content, under what conditions, and how to govern it
Learning outcomes — by end of Day 2, students can…
Describe permission levelsExplain Owner, Member, and Visitor rights and the groups they map to
Configure site permissionsAdd groups at correct permission levels using Advanced permission settings
Break inheritance correctlyBreak inheritance on a library, remove inherited groups, set unique permissions
Use Check PermissionsRun the tool and interpret exactly why a user has or doesn't have access
Create sharing linksGenerate a specific-people link with view permission and expiry date
Audit via PowerShellUse Get-SPOSiteGroup and identify its limitations regarding broken inheritance
What you need ready
All department sites from Day 1 active
SharePoint Online PowerShell connected
Slide deck: inheritance diagram
Lab 4-B step sheet