📄 Article

SharePoint Online: Complete Administration Guide

✍️ Author: Techcareers
📂 Category: SharePoint Online
👥 Audience: M365 Administrators, SharePoint Admins
📅 Last Reviewed: 11 July 2026

SharePoint Online is the collaboration and content backbone of Microsoft 365 — powering team sites behind every Microsoft Team, hosting communication sites for intranets, and forming the storage layer for OneDrive. Interviews consistently test external sharing controls, permission inheritance, site types, and troubleshooting access issues. This guide covers all of them with real-world commands and model answers.

🏗️ Site Types: Team Sites vs Communication Sites

Aspect	Team Site	Communication Site
Purpose	Collaboration within a group or team	Broadcasting content to a wide audience
Backed by	Microsoft 365 Group (Entra ID)	No M365 Group — SharePoint-only
Default permissions	Owners, Members, Visitors via M365 Group	Site owner manages permissions directly
Typical use	Project teams, departments, Microsoft Teams	Company intranet, HR portal, announcements
Created by	Users (if allowed) or Teams creation	Site admins or authorised users

💡 Key Point

Every Microsoft Team automatically creates a SharePoint team site behind it. Channel files are stored in that site’s document library — one folder per standard channel. Deleting a Team also deletes its SharePoint site (after a soft-delete period).

🔗 Hub Sites

💡 What Hub Sites Do

A hub site is a SharePoint site registered as the root of a collection of associated sites. Hub association lets you roll up news and search results across all associated sites, apply consistent navigation and branding centrally, and surface content from child sites in the hub home page. Only SharePoint Administrators can register a site as a hub. Sites can be associated with (and disassociated from) a hub without losing their own settings. A site can only be associated with one hub at a time, but hubs themselves can be nested by associating a hub site to a parent hub.

The Four Sharing Levels

Level	What It Allows
Anyone	Shareable links that work without sign-in (anonymous). Most permissive.
New and existing guests	External users must authenticate (sign in or verify with a one-time passcode)
Existing guests only	Only guests already in your Entra ID directory can be shared with
Only people in your organisation	No external sharing at all. Most restrictive.

⚠️ Critical Rule — Tenant vs Site Level

Site-level sharing can only be equal to or more restrictive than the tenant level — never more permissive. If the tenant is set to “New and existing guests”, a site cannot be opened to “Anyone”. To restrict a specific site, set its level lower than the tenant level.

PowerShell — External Sharing Controls

Connect-SPOService -Url https://yourtenant-admin.sharepoint.com

# Block external sharing on a single site
Set-SPOSite -Identity https://yourtenant.sharepoint.com/sites/Finance -SharingCapability Disabled

# Allow only authenticated guests at tenant level
Set-SPOTenant -SharingCapability ExternalUserSharingOnly

# Restrict to specific external domains (allow list)
Set-SPOTenant -SharingDomainRestrictionMode AllowList -SharingAllowedDomainList "partner1.com partner2.com"

# Block specific domains (block list)
Set-SPOTenant -SharingDomainRestrictionMode BlockList -SharingBlockedDomainList "competitor.com"

👥 SharePoint Permission Model

💡 Default Permission Groups

Owners — Full Control. Can manage settings, permissions, and all content.
Members — Edit. Can add, edit, and delete content in the site.
Visitors — Read. Can view content only, cannot edit.

Broken Permission Inheritance

⚠️ The Most Common Permission Trap

By default, all lists, libraries, folders, and items inherit permissions from the site. If inheritance is broken on a library or folder (via “Stop Inheriting Permissions”), that item gets its own independent permission set. A user may have site-level access but be blocked at a library where inheritance is broken — or vice versa. This is the most common cause of unexpected SharePoint access issues and the first thing to check when permissions look correct at the site level but access is still denied.

PowerShell — Check Site Permissions

Connect-PnPOnline -Url https://yourtenant.sharepoint.com/sites/Finance -Interactive

# Check a specific user's permissions on a site
Get-PnPUserEffectivePermissions -Site https://yourtenant.sharepoint.com/sites/Finance -User user@domain.com

# Check if a list/library has broken permission inheritance
Get-PnPList -Identity "Documents" | Get-PnPProperty -Property HasUniqueRoleAssignments

💻 Restricting Access from Unmanaged Devices

💡 Conditional Access Integration

SharePoint Online integrates with Entra ID Conditional Access to restrict access from devices that are not Entra ID joined or Intune-compliant. In the SharePoint admin center → Policies → Access control → Unmanaged devices, you can choose: Allow full access, Allow limited, web-only access (no download/sync/print), or Block access entirely from unmanaged devices. This creates a corresponding Entra ID Conditional Access policy automatically. This is a common scenario in interviews about protecting corporate data on personal devices.

🔄 Site Lifecycle Management

💡 Microsoft 365 Group Expiry

Group-connected team sites (and their backing Teams) can be governed with an Entra ID group expiry policy. When configured, M365 group owners receive expiry notifications and must renew the group — or it (and its associated SharePoint site, Team, mailbox, and Planner) is automatically deleted after a grace period. Administrators can also set retention policies on SharePoint in Microsoft Purview to ensure content is preserved even after site deletion.

⚠️ Deleted Site Recovery

Deleted sites go to the SharePoint Deleted Sites container for 93 days
Restore via SharePoint admin center → Deleted sites, or via PowerShell: Restore-SPODeletedSite
After 93 days, permanent deletion — no recovery without third-party backup

🛠️ Troubleshooting SharePoint Access Issues

Use Check Permissions

Site Settings → Site permissions → Check Permissions. Enter the user’s name to see exactly what access they have and through which group, role, or sharing link. This is always the first step.

Check Group Membership

For group-connected sites, verify the user is a Member or Owner of the backing Microsoft 365 Group in Entra ID. Group changes can take a few minutes to propagate to SharePoint.

Look for Broken Inheritance

Navigate to the specific library, folder, or file the user can’t access. Check Library/List Settings → Permissions → whether the item inherits from the parent or has unique permissions.

Rule Out Policies

Conditional access (unmanaged device restriction), sensitivity label-based access blocks, and site-level sharing settings can deny access even when permissions are correctly assigned. Check SharePoint admin center → Access control and the site’s sharing settings.

💡 Best Practices & Recommendations

Manage permissions through the Microsoft 365 Group — avoid item-level permission inheritance breaks wherever possible, as they become unmanageable at scale
Set default sharing links to “People with existing access” or “Specific people” rather than “Anyone” at the tenant level
Use hub sites to unify navigation, branding, and search across related department sites instead of deeply nested subsite structures
Enable Purview retention policies on SharePoint before you need them — data recovery options depend entirely on what’s been configured in advance
Use domain allow/block lists for partner collaboration rather than fully opening external sharing tenant-wide
Review guest access quarterly using Entra ID access reviews to remove stale external users

🎓 Common Interview Questions

Q: What is the difference between a Team site and a Communication site in SharePoint Online?

A Team site is backed by a Microsoft 365 Group and is designed for collaboration within a specific group — every Microsoft Team has one automatically. A Communication site has no M365 Group, is designed for broadcasting content to a wide audience (intranets, announcements, HR portals), and permissions are managed directly by the site owner rather than through a group. Team sites are “inside-out” (members contribute), Communication sites are “outside-in” (a few publish, many read).

Q: A user has site access but cannot open a specific document library — what do you check?

Check for broken permission inheritance on the library. Go to Library Settings → Permissions → if it says “This library has unique permissions”, the library has been disconnected from the site’s permission model and has its own independent set. Use Check Permissions (Site Settings → Site permissions → Check Permissions) to confirm exactly what access the user has on that specific library, then restore inheritance or add the user directly if appropriate.

Q: What are hub sites and why would you use them?

Hub sites allow you to associate related SharePoint sites under a parent hub to share navigation, branding, and search scope. News and events from associated sites roll up to the hub home page. Only SharePoint Administrators can register a site as a hub. They are the recommended alternative to subsite hierarchies, which are complex to manage and don’t scale well. A site can be in only one hub at a time.

Q: What permissions are needed to administer SharePoint Online?

The SharePoint Administrator role grants access to the SharePoint admin center and full control over all site collections. A Site Collection Administrator has full control over a specific site and can be assigned per-site without broader admin rights. Global Administrator also has full SharePoint access but should not be used for routine SharePoint administration — the dedicated SharePoint Administrator role follows least-privilege best practice.

📚 References & Further Reading

🔗 External sharing overview in SharePoint and OneDrive — Microsoft Learn
🔗 Planning your SharePoint hub sites — Microsoft Learn
🔗 Set up a SharePoint hub site — Microsoft Learn
🔗 Control access from unmanaged devices — Microsoft Learn

🎓 View Interview Prep Guide →