Module 4 of 7

🎯 SharePoint Course · Module 4 of 7

Permissions & Access Control

📂 Course: SharePoint Online Administration
📦 Module: 4 of 7
🎯 Exam: MS-102
⏱ Read time: ~24 min

MS-102 Exam Alignment
MS-102

Manage SharePoint permissions: Understand SharePoint permission levels, default SharePoint groups (Owners/Members/Visitors), permission inheritance, breaking inheritance, and unique permissions on lists, libraries, and items.

Know the default permission levels: Full Control, Design, Edit, Contribute, Read, View Only, Limited Access — and which groups use which by default
Know that SharePoint permissions flow by inheritance: site → sub-site → library → folder → item. Breaking inheritance at any level creates unique permissions for that object
Know that Limited Access is a system-generated permission level automatically assigned when someone has access to an item but not the parent library — do not assign it manually
Know the four sharing link types and when each is appropriate for access control (links create temporary access, permissions are persistent)

Exam Tip: Microsoft recommends managing SharePoint permissions at the site level through SharePoint groups (Owners, Members, Visitors), not by assigning individual users directly to permission levels. Direct user permission assignment creates unmanageable individual entries that are difficult to audit and maintain. Use groups — always assign permissions to groups, never to individuals.

SharePoint’s permission system works in layers — the site has permissions, libraries inherit from the site, folders inherit from the library, and items inherit from the folder. Administrators can break this inheritance at any level to create unique permissions for specific content. Understanding this inheritance chain is fundamental to diagnosing and resolving SharePoint access issues.

🔑 SharePoint Permission Levels

Permission Level	What Users Can Do	Default Group Assignment
Full Control	All permissions — manage site settings, permissions, lists, libraries, pages, and content. Effectively a site administrator	Owners group
Design	Add, edit, delete lists and document libraries, approve items, and customise the look and feel of the site. Cannot change site permissions	Not assigned by default
Edit	Add, edit, and delete lists and their items. Cannot manage lists (no create/delete of lists). Common for team collaboration	Members group (M365 Group-connected sites)
Contribute	Add, edit, and delete items in existing lists and document libraries. Cannot create or delete entire lists	Members group (legacy/non-Group sites)
Read	View pages and items, download documents, but cannot add, edit, or delete anything	Visitors group
View Only	View pages and items in lists but cannot download documents. Used for sensitive documents where viewing in browser is allowed but saving a copy is not	Not assigned by default
Limited Access	Minimal access to a specific resource. Automatically assigned by the system when someone has access to a specific item or folder but not the parent — allows them to navigate to the content	System-assigned — do not assign manually

👥 Default SharePoint Groups

Group	Default Permission Level	Typical Members	M365 Group-Connected Sites
[Site name] Owners	Full Control	Site administrators, IT managers, team leads who manage the site	Synced with M365 Group Owners
[Site name] Members	Edit (or Contribute on legacy sites)	Active team members who contribute content	Synced with M365 Group Members
[Site name] Visitors	Read	Stakeholders, wider audience who need to read but not edit	Not synced — must be managed in site settings

⚠️ M365 Group-Connected Sites: Permissions Sync

For Team sites connected to a Microsoft 365 Group, the SharePoint Owners group is automatically kept in sync with the M365 Group Owners, and the Members group is synced with M365 Group Members. Adding someone to the M365 Group also grants them SharePoint Member access — and removing them from the group removes their SharePoint access. The Visitors group is NOT synced and must be managed directly in SharePoint site permissions.

🔗 Permission Inheritance

By default, every object in SharePoint inherits its permissions from its parent.

Permission inheritance chain

Site collection

→ Defines the top-level permissions pool

↓ inherits

Document Library

→ Same permissions as site by default

↓ inherits

Folder

→ Same permissions as library

↓ inherits

File/Item

→ Same permissions as folder

⚡ Breaking inheritance at any level → that object and all below it get unique permissions (no longer inheriting from parent)

Breaking Inheritance

When you break inheritance on a list, library, folder, or item, you create a copy of the current inherited permissions as a starting point for unique permissions. Changes to the parent permissions no longer flow down to the broken-inheritance object.

⚠️ Broken Inheritance — Maintenance Overhead

Breaking inheritance on individual items creates a permissions management nightmare at scale. If a user is removed from the Owners group, that change does NOT propagate to any item with broken inheritance. Microsoft’s recommendation: avoid breaking inheritance wherever possible. Instead, use separate document libraries or sites for content that needs different permission levels. Only break inheritance at the library or folder level as a last resort, and never at the individual item level unless absolutely required.

PowerShell — Permission Management (PnP PowerShell)

Connect-PnPOnline -Url https://your-tenant.sharepoint.com/sites/ProjectSite -Interactive

# List all site groups and their members
Get-PnPSiteGroup | Select-Object Title,LoginName

# Add a user to the Members group
Add-PnPGroupMember -LoginName user@contoso.com -Group 'ProjectSite Members'

# Check if a library has unique (broken inheritance) permissions
$lib = Get-PnPList -Identity 'Documents'
if($lib.HasUniqueRoleAssignments){'Unique permissions set'} else {'Inheriting from site'}

# Break inheritance on a library (copy current permissions as starting point)
Set-PnPList -Identity 'Confidential' -BreakRoleInheritance -CopyRoleAssignments

💡 Best Practices

Always assign permissions to SharePoint groups or Entra ID security groups — never to individual users. Groups are maintainable; individual direct assignments accumulate invisibly and become impossible to audit
Use separate document libraries for content requiring different access levels instead of breaking inheritance on individual items — a “Confidential” library with unique permissions is far easier to manage
For M365 Group-connected Team sites, manage ownership and membership via the Microsoft 365 Group (Teams admin, Entra, or M365 admin center) rather than directly in SharePoint — changes to M365 Group members automatically sync to SharePoint
Conduct a quarterly permissions audit using the Site permissions report to identify over-privileged users and stale access entries

🎓 Interview Q&A

Q: A user tries to open a specific document and receives “Access Denied” even though they are a member of the site’s Members group. What is the most likely cause?

The most likely cause is broken permission inheritance on the document or its parent folder/library. When inheritance is broken, changes to the parent site’s permissions (including the Members group) no longer flow down to that content. The document has unique permissions that do not include the user. To investigate: open the document’s properties in SharePoint → More → Manage Access (or Advanced Permissions) to see the current direct permissions. The fix is either to add the user to the unique permissions for that item, or to restore inheritance (Permissions → Inherit Permissions) which will remove all unique permissions and reconnect to the parent’s permission set.

🎯 MS-102 Mock Test

Module 4 — Permissions & Access Control

5 questions · Scenario-based · Pass mark: 70%

Q1 of 5

A SharePoint Team site is connected to a Microsoft 365 Group. An admin adds a user to the site’s Visitors group in SharePoint site permissions. The user can view documents. Three days later, the Visitors group is removed from the site’s permissions. The user can still access the site. Why?

AVisitors group changes take 72 hours to replicate

BThe user was also added to the M365 Group Members — which gives them Member access independent of the Visitors group

CThe user was added directly to the Read permission level, not just the Visitors group — direct user assignments persist even after the group is removed

DSharePoint retains deleted group membership for 30 days

✅ C. When a user is added to a SharePoint permission level directly (not through a group), that individual permission assignment persists even if all groups that included them are removed. This is why Microsoft recommends always assigning permissions through groups — removing a group from site permissions removes all members’ access simultaneously.

Q2 of 5

A site owner breaks inheritance on a specific folder so that only the HR team can access it. Two weeks later, a new user is added to the Members group. Do they have access to the HR folder?

ANo — the HR folder has unique permissions (broken inheritance). Changes to the Members group do not automatically apply to content with broken inheritance

BYes — new Members group members always get access to all content in the site

CYes — but only after 24 hours for the broken inheritance to recognise new group members

DNo — but the site owner can manually grant access to the new user for the folder

✅ A. Once inheritance is broken on the HR folder, it has its own independent permissions that are no longer connected to the site’s permission groups. Adding a new user to the Members group grants them access to everything that still inherits from the site — but not to the HR folder, which has unique permissions excluding the Members group.

Q3 of 5

A user tries to access a SharePoint document library but receives an error. When you check their permissions, they are listed as having “Limited Access” to the site. What does this indicate?

AThe user has been blocked from the site and needs to be re-invited

BLimited Access means read-only access to the entire site

CThe admin manually assigned Limited Access — the user needs a higher permission level

DThe user has access to a specific item or folder with unique permissions, but not the parent site — SharePoint automatically assigns Limited Access to the site so they can navigate to the content they do have access to

✅ D. Limited Access is a system-assigned permission level that SharePoint automatically creates when someone has been given access to a specific item or folder with unique permissions, but has no other access to the parent site. SharePoint must assign them some minimal level of access to the site so they can navigate to the content. It should never be manually assigned by admins.

Q4 of 5

Which permission level should be assigned to external auditors who need to view SharePoint documents in the browser but must not be able to download, print, or save copies of the files?

ARead — auditors only need to read content

BView Only — allows viewing in browser but prevents downloading or saving copies of documents

CContribute — auditors need to add comments, which requires Contribute

DLimited Access — the most restrictive available permission level

✅ B. View Only is the correct permission level for this scenario. Unlike Read (which allows downloading), View Only permits users to see document contents in the browser but blocks the download button — the document opens in the Office Online viewer but users cannot save a local copy. This is ideal for sensitive documents where viewing is authorised but exfiltration must be prevented.

Q5 of 5

A site has 50 document libraries. A new compliance requirement means all 50 libraries must restrict access to a specific security group. What is the most efficient approach?

ABreak inheritance on all 50 libraries and add the security group to each individually

BCreate a separate SharePoint group for each library

CAdd the security group to the site Members group so it inherits access to all 50 libraries

DAdd the security group to the site’s permission group at the site level — since all libraries inherit from the site, the security group automatically gets access to all 50 libraries through inheritance

✅ D. Adding the security group at the site level is the most efficient approach because all 50 libraries inherit their permissions from the site. A single action at the site level automatically grants access across all inheriting libraries without touching each library individually. Breaking inheritance on all 50 libraries (A) is the opposite of efficient and creates a significant ongoing maintenance burden.