Access to this page requires authorization. You can try signing in or changing directories . Access to this page requires authorization. You can try changing directories . While SharePoint offers various permission levels for sites, use the built-in SharePoint groups for communication sites and manage team site permissions through the associated Microsoft 365 group. This approach makes administration easier. For information about managing permissions in the SharePoint modern experience, see Sharing and permissions in the SharePoint modern experience . Understanding permission levels The easiest way to work with permissions is to use the default groups and permission levels, which cover most common scenarios. But, if you need to, you can set more fine-grained permissions beyond the default levels. This article describes the different permissions and permission levels, how SharePoint groups and permissions work together, and how permissions cascade through a site collection. Want to go straight to the steps for changing or setting permission levels? See How to create and edit Permission Levels . Overview and permissions inheritance If you work on a site, you're working inside a site collection. Every site exists in a site collection, which is a group of sites under a single top-level site. The top-level site is the root site of the site collection. The following illustration of a site collection shows a simple hierarchy of sites, lists, and list items. The permissions scopes are numbered, starting at the broadest level at which you can set permissions, and ending at the narrowest level (a single item in a list). An important concept to understand is permissions inheritance. By design, all the sites and site content in a collection inherit the permissions settings of the root or top-level site. When you assign unique permissions to sites, libraries, and items, those items no longer inherit permissions from their parent site. Here's more information on how permissions work within the hierarchy: A site collection administrator configures permissions for the top level site or root site for the whole collection. A site collection administrator configures permissions for the top level site or root site for the whole collection. If you're a site owner, you can change permission settings for the site, which stops permission inheritance for the site. If you're a site owner, you can change permission settings for the site, which stops permission inheritance for the site. Lists and libraries inherit permissions from the site to which they belong. If you're a site owner, you can stop permissions inheritance and change the permission settings for the list or library. Lists and libraries inherit permissions from the site to which they belong. If you're a site owner, you can stop permissions inheritance and change the permission settings for the list or library. List items and library files inherit permissions from their parent list or library. If you have control of a list or library, you can stop permissions inheritance and change permissions settings directly on a specific item. It's important to know that a user can interrupt the default permission inheritance for a list or library item by sharing a document or item with someone who doesn't have access. In that case, SharePoint automatically stops inheritance on the document. List items and library files inherit permissions from their parent list or library. If you have control of a list or library, you can stop permissions inheritance and change permissions settings directly on a specific item. It's important to know that a user can interrupt the default permission inheritance for a list or library item by sharing a document or item with someone who doesn't have access. In that case, SharePoint automatically stops inheritance on the document. Default permission levels Default permission levels make it easy to give common levels of permissions to one user or groups of users. You can change any of the default permission levels, except Full Control and Limited Access . The following table describes these two permission levels. Microsoft 365 subscriptions create a security group called "Everyone except external users" that contains every person you add into the Microsoft 365 directory (except people who you add explicitly as External Users). This security group is added to the Members group automatically on Modern Team sites with Public privacy settings, so that users in Microsoft 365 can access and edit the SharePoint site. Also, for Modern Team sites created as Private , "Everyone except external users" can't be granted any permissions and people must be explicitly granted permissions. In addition, Microsoft 365 subscriptions create a security group called "Company Administrators", which contains Microsoft 365 Admins (such as Global and Billing Admins). This security group is added to the Site Collection Administrators group. For more info, see Default SharePoint groups . By default, site owners and members can add new users to the site. To learn more about "Everyone except external users" permission, see Special SharePoint Groups . Permission levels and SharePoint groups Permission levels work together with SharePoint groups. A SharePoint group is a set of users who all have the same permission level. The way this works is that you put related permissions together into a permission level. Then you assign that permission level to a SharePoint group. By default, each kind of SharePoint site includes certain SharePoint groups. For example, a Team Site automatically includes the Owners, Members, and Visitors group. A Publishing Portal site includes those groups and several more, such as Approvers, Designers, Hierarchy Managers, and so on. When you create a site, SharePoint automatically creates a pre-defined set of SharePoint groups for that site. In addition, a SharePoint admin can define custom groups and permission levels. To learn more about SharePoint groups, see Understanding SharePoint groups . The SharePoint groups and permission levels that are included by default in your site might differ, depending on: The template that you choose for the site The template that you choose for the site Whether a SharePoint admin created a unique permissions set on the site that has a specific purpose, such as Search

Whether a SharePoint admin created a unique permissions set on the site that has a specific purpose, such as Search The following table describes the default permission levels and associated permissions for three standard groups: Visitors, Members, and Owners. Site permissions and permission levels Site permissions apply generally across a SharePoint site. The following table describes the permissions that apply to sites, and shows the permission levels that use them. List permissions and permission levels List permissions apply to content in lists and libraries. The following table describes the permissions that apply to lists and libraries, and shows the permission levels that use them. Personal permissions and permission levels Personal permissions apply to content that belongs to a single user. The following table describes the permissions that apply to personal views and web parts, and shows the permission levels that use them. Permissions and dependent permissions SharePoint permissions can depend on other SharePoint permissions. For example, you must be able to open an item to view it. In this way, View Items permission depends on Open permission. When you select a SharePoint permission that depends on another, SharePoint automatically selects the associated permission. Similarly, when you clear SharePoint permission, SharePoint automatically clears any SharePoint permission that depends on it. For example, when you clear View Items, SharePoint automatically clears Manage Lists (you can't manage a list if you can't view an item). The only SharePoint permission without a dependency is Open. All other SharePoint permissions depend on it. To test a custom permission level, you can just clear "Open". This action automatically clears all other permissions. The following sections contain tables that describe SharePoint permissions for each permission category. For each permission, the table shows the dependent permissions. Site permissions and dependent permissions Site permissions and dependent permissions List permissions and dependent permissions List permissions and dependent permissions Personal permissions and dependent permissions Personal permissions and dependent permissions Site permissions and dependent permissions The following table describes the permissions that apply to sites, and shows the permissions that depend on them. List permissions and dependent permissions The following table describes the permissions that apply to lists and libraries, and shows the permissions that depend on them. Personal permissions and dependent permissions The following table describes the permissions that apply to personal views and web parts, and shows the permissions that depend on them. Limited-access user permission lockdown mode is a site collection feature that you can use to secure published sites. When you turn on lockdown mode, it reduces fine-grain permissions for the limited access permission level. The following table details the default permissions of the limited access permission level and the reduced permissions when the lockdown mode feature is turned on. Lockdown mode is on by default for all publishing sites, including if a legacy publishing site template is applied to the site collection. Lockdown mode is the recommended configuration if greater security on your sites is a requirement. If you disable the limited-access user permission lockdown mode site collection feature, users in the "limited access" permissions level (such as Anonymous Users) can gain access to certain areas of your site. Plan your permission strategy Now that you understand permissions, inheritance, and permission levels, plan your strategy. Set guidelines for your users, minimize maintenance, and ensure compliance with your organization's data governance policies. For tips on planning your strategy, see Plan your permissions strategy . Was this page helpful? Need help with this topic? Want to try using Ask Learn to clarify or guide you through this topic? Additional resources Last updated on 2025-04-30