I have been tasked with redoing our departments SharePoint Site. The main thing I am tackling, which is new to me, is re-organizing the permissions. People would request access and they would be added. I want to create groups and assign everyone to the specific groups. Would this be a reasonable solution at least from an organizational standpoint? Let's say there are 25 people with Read only rights. I want to create a group LibraryX - Read and move the readers there. Is there a better way to organize the permissions?

2 Answers 2


That is the preferred approach yes. You can group people by general access this way and it works pretty well.

The other option is to create groups based on roles and then you assign permissions to sites and document library permissions based on what the roles should have. Sometimes it's easier to grant permissions to the "Day Shift Users" or "Senior Management" versus Members.

  • Thank you. I just started at the company and it looks like 2 years ago they started an initiative to clean things up. The person who made the groups set himself as owner, and only the owner was able to view members, or make changes. I got out Admin to appoint me to Site Collection Admin to clean these groups up so now I am focusing on assigning permissions back to everyone, It is a tedious task but will be used as an example throughout the company. Do you know of any good articles that deal with handling SharePoint permissions? Nov 15, 2016 at 17:51

In our environment, we use three basic groups. If we had a Sales site, for example, we would then create three groups: Sales Owners, Sales Members, and Sales Visitors.

From there, Sales Owners would have Site Owner permissions and be locked down to just a few people that have gone through some training with our team and whom we can trust not to royally mess things up.

Sales Members would be a slightly larger group that has/needs Contribute permissions, and obviously they would then be able to Contribute to the site and the lists and libraries within.

Sales Visitors includes everyone authenticated to the site (we use AD integration) and they have Read-Only permissions. We use Security Groups here, primarily.

Of course, different departments and areas will have different needs, but that's the general idea that we use, and deal with exceptions as they come up.

  • Thank you for the response. We have a similar setup, but there are tons of libraries that exist within our Operations site. I am not able to create a group let's say Operations - Visitors, and then assign that group to different libraries and have only the specific employee have permissions? By that I mean I have person X and Person Y as member of Operations - Visitors. Person X can view Library X and Person Y can view Library Y but X cannot view Y and vice versa? These should be separate groups correct? Nov 15, 2016 at 17:54
  • Yes, those would need to be separate groups. Technically, I believe you could change the permissions/groups at the library level, but this is not considered best practice; breaking permissions inheritance in general is not considered best practice. Nov 15, 2016 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.