SharePoint permission inheritance explained: the complete reference

Last updated August 4, 2026 · By Sean Regan

1. The SharePoint permissions model

SharePoint Online uses a role-based access control (RBAC) model. Three primitives compose every permission decision^[1]:

• Principals — users, Microsoft Entra security groups, Microsoft 365 Groups, and SharePoint groups.
• Permission levels — named bundles of granular permissions (e.g. Read, Contribute, Edit, Full Control).
• Role assignments — the binding of one principal to one permission level at one scope.

A user's effective permissions at any scope are the union of every role assignment that resolves to them — directly, through any Entra group, through any M365 Group, and through any SharePoint group. SharePoint does not implement "deny" entries; permissions are additive only^[1].

2. Securable scopes

SharePoint stores role assignments at five scopes, each a child of the previous:

Each scope exposes HasUniqueRoleAssignments and RoleAssignments properties via the SharePoint REST API and Microsoft Graph^[4].

3. How inheritance actually works

By default every child scope points at its parent's role-assignment collection. There is no copy: reading RoleAssignments on an inheriting child returns the parent's collection by reference. This is why granting Read on a site collection is instant for every library underneath it — no propagation job runs^[1].

When inheritance is broken, SharePoint snapshots the parent's role assignments into a new collection owned by the child. From that point the child is independent: granting on the parent no longer flows down, and removing a principal from the parent does not remove them from the child.

4. Breaking and restoring inheritance

Inheritance is broken in three ways:

1. An admin clicks Stop inheriting permissions on a site, library, folder, or item.
2. A user shares an item or folder with a person who does not already have access at a higher scope.
3. A script calls BreakRoleInheritance(copyRoleAssignments, clearSubscopes) via CSOM/REST.

The reverse — Reset role inheritance — discards the child's independent role assignments and re-points at the parent. Any unique grants on the child are lost permanently; there is no built-in undo. Always export a permissions report before resetting inheritance on a scope you do not fully understand^[2].

5. Sharing links and unique permissions

In modern SharePoint Online, sharing links are the dominant source of unique permissions. Every sharing link is an object stored on the item, and most link types break inheritance on that item the moment they are created^[2]:

Specific-people links generate a guest account in Entra ID for external recipients. Removing the link does not delete the underlying role assignment unless you also click Stop sharing on the item.

6. M365 Groups, Teams, and SharePoint groups

Group-connected sites (every Teams-backed and modern team site) ship with three principals bound at the site-collection scope:

• Site Owners SharePoint group → Full Control
• Site Members SharePoint group → Edit
• Site Visitors SharePoint group → Read

The Owners and Members SharePoint groups contain the matching M365 Group as a nested principal, so adding a user to the Team or M365 Group grants them SharePoint access automatically. Adding users directly to the SharePoint groups bypasses the M365 Group and is the most common cause of "why can this person see SharePoint but not the Team?" tickets^[1].

7. Permission levels reference

Custom permission levels can be cloned and modified per site collection^[1].

8. How to audit permissions across a tenant

There is no native cross-site permissions report in SharePoint Online. To enumerate every unique-permission scope across a site collection you must walk the object graph: site → lists → folders → items, checkingHasUniqueRoleAssignments at each level^[4]. Options:

• PowerShell + PnP — flexible but slow at scale; throttling is common on large tenants.
• Microsoft Graph — the permissions endpoint exposes role assignments per drive item^[4].
• Paid tools — ShareGate Protect, AvePoint Insights, Syskit Point. License costs typically $4–8/user/year.
• Free SPFx web part — SharePoint Smart Permissions runs entirely client-side in your tenant, walks the same Graph endpoints, and exports to Excel.

9. Troubleshooting effective permissions

Most real-world permission tickets resolve to one of a handful of causes. This table maps the symptom to the scope you should inspect first.

Limited Access is worth understanding on its own. When a user is granted access to a single item, SharePoint automatically assigns Limited Access at every ancestor scope so the request can traverse the URL path. It confers no ability to browse those ancestors, and it cannot be granted directly — seeing it in a report is a signal that an item- or folder-scope grant exists below.

10. A governance lifecycle that actually holds

Inheritance decays. Every sharing link, every "just give Sarah access to this one folder" creates a scope that nobody will remember in eighteen months. The only durable fix is a recurring review cadence, not a one-off cleanup:

1. Baseline — export a full unique-permissions report per site collection and store it dated. This is the artifact every later review compares against.
2. Quarterly delta — re-run and diff. New unique scopes since last quarter are the only rows a site owner needs to look at, which keeps the review to minutes rather than hours.
3. Owner attestation — send each site owner only their own rows. Central IT cannot adjudicate whether a finance contractor should still see a folder; the owner can.
4. Expiry by default — set organization-level link expiration in the SharePoint admin center so the majority of item-scope grants clean themselves up.
5. Pre-Copilot sweep — before enabling Copilot, run the report against your ten largest sites and resolve organization-wide links first. Copilot amplifies whatever oversharing already exists.

A practical walkthrough of steps 1-3 is in how to run an audit with Smart Permissions.

Frequently asked questions

References

1. [1] Microsoft Learn — Understanding permission levels in SharePoint
2. [2] Microsoft Learn — Sharing and permissions in the SharePoint modern experience
3. [3] Microsoft Learn — App-only authentication for SharePoint Online
4. [4] Microsoft Graph — permission resource type

Related

• SharePoint Online migration: complete reference · SharePoint governance: complete reference
• SharePoint permissions tools comparison
• Free ShareGate Protect alternative, AvePoint Policies & Insights alternative, Syskit Point alternative, Lepide alternative
• How to audit SharePoint permissions · Permissions report by user · External sharing report for Copilot readiness