0

I have a Modern Site connected to a M365 Group. Aside from the site owners, I want everyone else to only have Read permissions to everything (unless otherwise specified, per-list/library and per-document). "Everyone else" will almost always be external users to the tenant, granted access through invitation.

When the default Site Members group has Edit permissions, these external users - who are part of the Site Visitors group - still has the ability to edit documents in libraries/lists that are inheriting permissions from the parent. Why is that?

And if I change the Site Members group's permissions to Read, then even when I grant an external user Edit permissions to a document, they still cannot edit the document and the permissions sometimes don't even get updated on the Manage Access page for the document. If I go to the advanced page for the permissions on the document and check that external user's permissions directly, "Contribute" is listed as "given directly".

What's going on here? Am I setting permissions incorrectly?

EDIT 8/24/2021: Adding screenshots of how permissions are currently configured

Site Permissions - Members have Read permissions only

Site Permissions

Site Permissions Advanced (Note: Members are listed with Edit permissions! Shouldn't it be Read, as per the first screenshot?)

enter image description here

Library Permissions (for Site Pages)

enter image description here

Item Level Permissions + Sharing Link (my external user granted edit permissions)

enter image description here

Effective Permissions - Site and Site Pages (again - Members showing as having Edit permissions, which doesn't seem right)

enter image description here

Effective Permissions - Item Level

enter image description here

It seems the last image shows the problem. Shouldn't the Read permissions granted by the user's membership in Visitors be superseded by the item-level Edit permissions?

0

According to my understanding:

  • Add "Everyone except external users" to the Site Members group, and the Site Members group has Edit permissions.
  • Add External users to the Site Visitors group, and the Site Visitors group has Read permissions.
  • However, these External users can still edit documents in libraries/lists that inherit permissions from the parent.

Please perform the following troubleshooting:

1.Access to the Site Permissions page to check user permissions. Please check whether the External user has only Read permissions.

enter image description here

2.Ensure that the list/library inherits permissions from the parent.

enter image description here

3.Select the document/item and click on Manage access

enter image description here

4.On the Manage Access panel, click on Advanced

enter image description here

5.Ensure that the document/item inherits permissions from the parent. Of course, you can also check at the document-level (item-level) whether the External user has only Read permissions

enter image description here

========================= Updated Answer ===========================

On the Site Permissions Level: External user exists in both the Site Members group and the Site Visitors group.

When a user has different permission levels, the SharePoint defaults that the user's permission level is the highest among these different permission levels. This means that the External user has Edit permissions.

enter image description here

If you want to everyone else (always external users) have Read permissions to everything (unless otherwise specified, per-list/library and per-document), please the following steps:

1.Restore the Site permissions settings, List or Library permissions settings and Item permission settings to the original default settings

enter image description here

2.On the Site Permissions page, clikc on Create Group named "Everyone Else" and grant Read Permissions.

enter image description here

3.On the Everyone else group, click on New to add all external users to this group.

enter image description here

4.Go back the Site Permissions page and refresh page, to check the external user permissions.

enter image description here

enter image description here

5.If you want to the external user has other permissons for specifice list/library/item/file. You can Stop Inheriting Permissions and grant the user permissions directly without adding him/her to the group.

4
  • Thanks - I've updated my question with screenshot of the current config. It seems the item is not inheriting access from the parent Site Pages library? Something looks off as well with the Members group only having Read permissions, but still showing up as having Edit rights. Yet, my user is explicitly given Edit permissions and that is being superseded by its membership in Visitors?? And if Members has Edit (which it shouldn't), and my user is in Members, shouldn't that also give my user Edit? Aug 24 at 14:49
  • I have updated answer under initial My Answer. Hope this can help you to solve issue. Have a nice day! Aug 26 at 9:35
  • Thank you, this makes sense. Aug 27 at 15:45
  • Thanks for you reply. I'm glad I can help you solve the problem. Aug 30 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.