Contoso Legal LLP
contoso.onmicrosoft.com
Guests with full control
1
Can change permissions and delete anything
People given access directly
2
Not through a group, so easy to forget
Open to everyone
1
Everyone or Everyone except external users
Lists and libraries with their own permissions
2
On 2 sites
Sites
5
Not counting OneDrives
Who has access to each site 16SharePoint groups 3Lists and libraries with their own permissions 2Subsites with their own permissions 1Access by person 21
Every permission level on each site, with SharePoint groups opened up into their members. Permissions on single files and folders are in File and folder permissions.
| Who | Type | How | Permission level | Outside the organisation |
|---|---|---|---|---|
| Owners of Clients | Microsoft 365 group owners | Through Clients Owners | Full Control | No |
| Members of Clients | Microsoft 365 group | Through Clients Members | Edit | No |
| d.mason@mason-legal.example low | Guest | Given directly | Read | Yes |
| Owners of Finance | Microsoft 365 group owners | Through Finance Owners | Full Control | No |
| Members of Finance | Microsoft 365 group | Through Finance Members | Edit | No |
| accounts@ | Guest | Given directly | Full Control | Yes |
| Owners of Marketing | Microsoft 365 group owners | Through Marketing Owners | Full Control | No |
| Members of Marketing | Microsoft 365 group | Through Marketing Members | Edit | No |
| Owners of Operations | Microsoft 365 group owners | Through Operations Owners | Full Control | No |
| Members of Operations | Microsoft 365 group | Through Operations Members | Edit | No |
| annabel.fraser@ | Person | Through Staff Intranet Owners | Full Control | No |
| annabel.fraser@ | Person | Through Staff Intranet Members | Edit | No |
| evie.davis@contoso.example | Person | Through Staff Intranet Members | Edit | No |
| owen.taylor@contoso.example | Person | Through Staff Intranet Members | Edit | No |
| william.clark@contoso.example | Person | Through Staff Intranet Members | Edit | No |
| Everyone except external users low | Everyone | Through Staff Intranet Visitors | Read | No |
Lists and libraries that stopped inheriting their site's permissions, so the site's groups don't say who can open them. Each is worth a look: the reason is often a one-off that was never undone.
| Site | List or library | Type | Items | Who can open it |
|---|---|---|---|---|
| Clients low | Engagement letters | Library | 38 | Clients Owners (Full Control), Clients Members (Contribute), D Mason (Read) |
| Finance | Payroll | Library | 64 | Finance Owners (Full Control), Joseph Morris (Edit) |
Subsites that don't inherit their parent site's permissions.
| Site | Subsite | Who can open it |
|---|---|---|
| Staff Intranet | HR | Staff Intranet Owners (Full Control), Joseph Morris (Edit) |
Everyone who can get into at least one site, through any group or directly, with guests and outside accounts first. Microsoft 365 and security groups are opened up where the Groups collection has their members.
| Person | Outside the organisation | Sites | Highest level | Which sites |
|---|---|---|---|---|
| accounts@ | Yes | 1 | Full Control | Finance |
| d.mason@mason-legal.example low | Yes | 1 | Read | Clients |
| annabel.fraser@ | No | 5 | Full Control | Clients, Finance + 3 more
|
| jacob.johnson@contoso.example | No | 4 | Full Control | Clients, Finance + 2 more
|
| owen.taylor@contoso.example | No | 4 | Edit | Clients, Finance + 2 more
|
| rhys.evans@contoso.example | No | 4 | Edit | Clients, Finance + 2 more
|
| evie.davis@contoso.example | No | 3 | Full Control | Clients, Operations, Staff Intranet |
| jack.white@contoso.example | No | 3 | Edit | Clients, Finance, Operations |
| lily.harrison@contoso.example | No | 3 | Edit | Finance, Marketing, Operations |
| oliver.hill@contoso.example | No | 3 | Edit | Clients, Marketing, Operations |
| sophie.taylor@contoso.example | No | 3 | Edit | Clients, Marketing, Operations |
| ella.thomas@contoso.example | No | 2 | Edit | Clients, Operations |
| joseph.morris@contoso.example | No | 2 | Full Control | Finance, Operations |
| megan.smith@contoso.example | No | 2 | Edit | Clients, Operations |
| noah.clark@contoso.example | No | 2 | Edit | Finance, Operations |
| william.clark@contoso.example | No | 2 | Edit | Clients, Staff Intranet |
| bobby.marsh@contoso.example | No | 1 | Full Control | Marketing |
| olivia.ward@contoso.example | No | 1 | Edit | Operations |
| olivia.wilson@contoso.example | No | 1 | Edit | Clients |
| priya.hughes@contoso.example | No | 1 | Edit | Operations |
| william.allen@contoso.example | No | 1 | Edit | Finance |
Read from SharePoint for 5 sites. Hidden levels such as Limited Access, which SharePoint adds when a single file is shared, are left out.
Data from Site permissions (), Groups and Teams (), Users ().