What this guide covers
SharePoint Online sells permissions and sharing as one feature, and most administrators treat them that way. That habit is behind a large share of access incidents. Authorization decides who can do what inside a site. Sharing decides whether content can leave the site at all. These are separate problems, they live on separate admin surfaces, and their controls do not overlap cleanly. You can build a textbook-correct site permission model and still watch an "Anyone" link walk a document out to an unauthenticated stranger. You can tighten a site's sharing dial and never notice that a Purview container label, a sensitivity label applied to the site itself rather than to the files inside it, is already enforcing something stricter underneath you.
This book holds both problems in view at once, which is the only way the product makes sense. It connects the SharePoint admin center, the Entra external collaboration settings that gate every guest before SharePoint ever sees the request, and the Purview labels that quietly override site settings. It names the failure modes before you meet them in production: the org-level ceiling no site can exceed, the re-enable trap that restores guest access when you toggle sharing back on, the scope-count limits that file-level sharing silently inflates (each uniquely permissioned item in a library is a permission scope, and a library caps out at 50,000), and the 2026 Entra B2B migration that strands legacy one-time-passcode guests.
Every product specific is grounded against current Microsoft Learn and validated in a live Microsoft 365 E5 lab. You do not need a production tenant to follow along; a trial tenant is enough to reproduce every walkthrough.
Chapter map
- How SharePoint Permissions and Sharing Fit Together
- Licensing, Prerequisites, and Admin Roles
- Permission Levels, What They Are and How They Stack
- SharePoint Groups and the Default Group Model
- Microsoft 365 Groups and Team Sites, How Group Membership Drives Permissions
- Permission Inheritance, Unique Permissions, and the Scope Model
- Site Collection Administrators and the Limited Access Permission
- Organization-Level External Sharing, The Tenant Policy Ceiling
- Site-Level External Sharing and Per-Site Sharing Controls
- Sharing Links, Types, Permissions, Expiration, and Defaults
- Entra B2B Integration, Guest Accounts, and One-Time Passcode
- Sensitivity Labels for Sites, Privacy, External Sharing, and Unmanaged Devices
- Before You Go to Production, Permissions and Sharing Readiness Checklist
Appendices: PowerShell and Graph Quick Reference; Build a Lab Tenant; Production Readiness Checklist.
Who it is for
This book is for SharePoint, Microsoft 365, and Teams administrators who run real tenants and want the moving parts connected rather than listed, along with MS-700, MS-102, and SC-300 candidates who keep meeting SharePoint permissions as one slice of a larger stack and want the depth those exams assume but never teach in one place.
