Permissions decide who can see, change, and share your team's files. When they are designed well, nobody notices them. When they are not, people are locked out of what they need or have access to what they should not.
This article explains the common building blocks of file permissions in collaborative workspaces, and offers a practical approach for keeping them understandable as a team grows.
The Core Permission Levels
Terminology varies between products, but most collaborative file systems offer variations of these levels.
| Level | What the person can usually do | Typical use |
|---|---|---|
| View / Read | Open and read; sometimes download | Reference documents, finished material |
| Comment / Review | Read and add comments or suggestions | Reviewers, stakeholders |
| Edit / Contribute | Change content, and sometimes add or delete files | Co-authors, project members |
| Manage / Owner | Change sharing settings and who has access | Project lead, workspace administrator |
Check how your own tool defines each level. For example, some systems allow a "view only" user to download a copy while others can block download; some "edit" roles can also delete files while others cannot.
Who Receives Permissions: People, Groups, and Links
Permissions can be attached to different kinds of recipients:
- Individuals: Specific named accounts.
- Groups or teams: Collections of people managed in one place.
- Everyone in the organization: A broad internal audience.
- Anyone with a link: A shareable link that may work without signing in, depending on settings.
As a rule, assign permissions to groups rather than individuals, and avoid broad link-based access for anything that is not meant to be public.
Understanding Inheritance
In many systems, items inherit permissions from the folder or space that contains them. If a folder is shared with the Finance group, files placed inside it are normally visible to Finance as well.
Why inheritance matters
- It makes administration scalable: change the folder, and everything inside follows.
- It can create surprises: moving a file into a different folder may change who can see it.
- Breaking inheritance for a single file (giving it unique permissions) solves special cases but creates exceptions that are easy to forget and hard to audit.
Practical rule
Keep exceptions rare. If you find yourself creating many files with unique permissions, it usually means the folder structure should be redesigned so that the exceptions get their own folder.
Designing a Simple Permission Model
A manageable model has three ingredients: a handful of groups, a predictable structure, and a short written rule set.
- Define groups by role or function (for example, Finance, Sales, Project Alpha Team).
- Attach permissions to top-level folders or spaces and let them flow downward.
- Use at least two groups per sensitive area: one with edit access and one with view-only.
- Name an owner for each area who approves new access requests.
Document the model on a single page. It should answer: "If I need access to X, who do I ask and how long does it take?"
Handling Access Requests
Make it easy to request access and easy to say no. Many tools offer a "request access" button that notifies the owner. Encourage requesters to state the reason, and encourage owners to grant the lowest level that meets the need. Record approvals for sensitive areas so that you can review them later.
Guests and External Collaborators
External collaborators, such as contractors, clients, or agencies, deserve extra care.
- Give guests access to a dedicated shared space rather than your internal folders.
- Prefer time-limited access with a defined end date.
- Review guest lists regularly and remove stale accounts.
- Check what guests can see beyond the file itself, such as member lists or other conversations in a shared workspace.
Whether guest access is available, and how it works, depends on your organization's settings and subscription.
Auditing Permissions
Permissions drift over time as people change roles and projects end. A basic audit checklist:
- Who has owner or manage rights? Is that list as short as it can be?
- Are there any "anyone with the link" shares on confidential material?
- Do former employees or contractors still appear in access lists?
- Are there files with unique permissions that no longer need them?
Run this review at least quarterly for sensitive areas, and after any restructuring. Related reading: How to Share Documents Securely With Colleagues.
Scenario: Restructuring a Folder With Mixed Access
A small accounting firm keeps client files in one shared folder. Over the years, a few files inside it were individually shared with outside clients, and several former contractors remain on the access list. Nobody is sure who can see what.
The office manager takes these steps:
- Exports or lists the current access for the folder and notes every file with unique permissions.
- Creates two groups: "Client Services Edit" and "Client Services View."
- Moves externally shared files into a new "Client Portal" folder with its own limited permissions.
- Removes former contractors and individuals who are now covered by the groups.
- Writes a half-page note describing the structure and who approves access requests.
The result is fewer exceptions and a model that a new employee can understand in a few minutes.
Common Mistakes
- Giving "edit" access when "view" or "comment" would do.
- Sharing individually with large numbers of people instead of using groups.
- Letting too many people hold manage-level rights.
- Moving files between folders without realizing permissions will change.
- Never reviewing who still has access.
Frequently Asked Questions
Why can I not open a file a colleague shared with me?
Common reasons include sharing the link without granting access to your account, a restriction to people inside a specific organization, or an expired link. Ask the owner to check the sharing settings.
Conclusion
File permissions are easiest to manage when the model is small and consistent: use groups, rely on inheritance, keep exceptions rare, and review access on a schedule. These habits protect information without slowing people down, and they make onboarding, offboarding, and audits dramatically simpler.
Independent educational content. Teams Knowledge is an independent educational resource. It is not affiliated with, endorsed by, or sponsored by Microsoft Corporation. Product names and trademarks belong to their respective owners. This article is general information, not professional advice. See our Disclaimer.
Related articles
How to Share Documents Securely With Colleagues
Practical habits for sharing files safely: choosing links versus invitations, setting access levels, protecting sensitive content, and reviewing sharing over time.
How to Organize Shared Files and Folders
Practical folder structures, naming conventions, and maintenance routines that make shared files easy to find and hard to lose.
Understanding Digital Collaboration Security
An accessible overview of the main risks in shared workspaces, from account takeover to oversharing, and the practical controls that reduce them.