Top 10 permissions and sharing traps

Permission mistakes in SharePoint rarely fail loudly: they either lock out the people who need access or leave content open to everyone. These ten are the ones that most often cost a day of investigation or a data exposure.

1. Breaking inheritance without copying keeps only YOU — and the re-grant forgets custom groupscopyRoleAssignments=false leaves only the caller, so re-adding the three default groups silently drops every other grant.copyRoleAssignments=false leaves exactly one role assignment (the caller), so re-granting Owners/Members/Visitors drops every direct grant and custom group; and an account that loses a configuration read can end up…
2. Hiding a field in an SPFx web part is not a permissionHiding a field in the UI hides nothing from REST or export; shows what real confidentiality takes and the traps it brings.Role-based UI field hiding is cosmetic; Read on the list = REST/Export/other web parts see it; confidentiality needs a separate list, item perms, or a server tier — plus the two traps the separate list creates: a…
3. A list with WriteSecurity 4 ignores Contribute — only ManageLists gets throughItem level write blocks are bypassed by Manage Lists, and giving a group Contribute after a break grants nothing extra.Only ManageLists (Design/Edit/Full Control) overrides the item-level write block, so "break inheritance + give the group Contribute" grants nothing; resolve the role by RoleTypeKind, not by its localised name
4. Contribute on the web lets a role edit and delete the pages of the site — including the page your app lives onContribute on the web, meant for list items, also lets people edit and delete every site page; break inheritance on Site Pages.Modern pages are items in the Site Pages library, which inherits from the web, so a group you give Contribute on the web "so it can write list items" can also edit and delete every page; withholding Manage Lists does…
5. A provisioned list with ReadSecurity=2 looks perfect to an admin and empty to everyone elseReadSecurity=2 looks perfect to an admin and empty to everyone else; test lists as an ordinary user before you ship.ReadSecurity=2 looks perfect to an admin and empty to everyone else; WriteSecurity=2 breaks collaborative edits only
6. Restoring inheritance is a one-way door — snapshot the unique assignments firstResetting inheritance discards unique assignments with no copy kept; undo works only if you saved them before the call.resetroleinheritance throws away every unique role assignment and SharePoint keeps no copy, so an "undo" is only possible if the code saved the assignments BEFORE the call; re-breaking with copyRoleAssignments=true…
7. GetUserEffectivePermissions ignores the user's Entra security groups — and Full Control's effective mask is not the role's maskChecking another user's access ignores Entra security groups and reports no access for people who have it; the reliable workaround.Asked on behalf of another user, GetUserEffectivePermissions counts Microsoft 365 group membership but not Entra security group membership — directly assigned or nested in a SharePoint group, still after 40 s — so it…
8. An Entra group inside a SharePoint group is invisible to every membership check SharePoint offersSharePoint never expands an Entra group inside a site group, so membership checks miss its people; resolve it through Graph.SharePoint accepts an Entra group as a member of a site group, then never expands it: currentuser/groups is direct-only and sitegroups/{id}/users returns the group, not its people — resolve with Graph checkMemberGroups…
9. Find externally / anonymously shared content via SearchOne security trimmed search query lists files shared outside the organisation; a fast start for an oversharing review.Oversharing / Copilot-readiness audit: ViewableByExternalUsers:1 surfaces files shared out, security-trimmed, one query
10. Guests cannot join a Teams shared channel — only people from another Microsoft 365 organisation canShared channels admit outsiders only through B2B direct connect, not guest accounts; know it before you promise a partner access.Shared channels admit external people only through B2B direct connect between two Entra tenants; a guest account cannot be added, so a partner without their own Microsoft 365 needs a different design

← all reading paths and Top 10 lists