Lydon Solutions

Construction Project Management Software Solutions

microsoft 365 permissions

Keep Your Construction Data Safe with Microsoft 365 Permissions – Part 3

How-To |

In part 1 of this three-part series on Microsoft 365 permissions, we discussed Microsoft 365 admin roles and application-specific permissions. In part 2, we covered Microsoft SharePoint permissions. In the final part of this series, we will focus on file-sharing permissions in Microsoft 365.  

With Microsoft OneDrive and SharePoint applications, you can share individual files and folders directly with internal and external team members. The process is much more straightforward than the permissions management process in SharePoint, as discussed in part 2 of this series. Still, it is easy to overlook the underlying sharing features because of its perceived simplicity. Without understanding the extent and interdependences of sharing, determining who has what permissions and what level of permissions users have across all assets in your libraries, folders, and sites can be challenging. 

Recently, Microsoft has unified the sharing menu across Microsoft 365 applications, so the sharing user interface is consistent, making it easier for users.  

The New File-Sharing Feature in Microsoft 365

The new Microsoft 365 sharing menu packs a lot of functionality!  

Once you select a folder or file, you can click on share to bring up a modal window with the option to choose with whom you want to share the file. There is also an area to provide a message if you intend to email a link to the record. You can also copy and send the link manually via email or chat or paste it into a document.  

Picture1

A few features worth highlighting in the new share menu:

1. Sharing settings – If you click on the cog in the top right of the share menu, you will access the sharing. Depending on your SharePoint administrator’s permission management controls, you can select categories of people you can share the file with and the permission level you want to be associated with the file. You can even block the file from being downloaded.

Picture2

2. Permission Levels -  If you click the down arrow next to the “add a name, group, or email” field where you input who you want to share a file with, you will get the permission levels you can assign to the file.

Picture3

You will better understand permission levels if you refer to part 2 of this series of permission management articles. With regards to SharePoint, these levels correlate to:

    1. Can edit -  Contribute access.
    2. Can view – Read access
    3. Can review – This is new to those familiar with SharePoint permission levels. “Can review” allows you to add comments to a document, but you do not have edit control.

3. Manage Access – If you click on the avatars (people icons) in the bottom left, you will access the Manage Access settings.

Picture5
  • You can grant access/permission to the file from here if you click on the plus avatar in the top right of the screen.
  • Under the People tab, you change a person’s access/permission level.
  • The Groups tab displays the number and list of permission groups assigned. Links will display a link aligning with the access/permission levels given so you can easily copy the links.

There’s a lot of functionality in this small modal window, but make sure to investigate to know exactly who can do what with your files.

You might wonder how this aligns with SharePoint since it has its own permission management structure. From Part 2 of this series, we referred to breaking inheritance when you assign unique permissions on each asset (list or library) in SharePoint. When you share a document directly using the share menu, it breaks the inheritance behind the scenes in SharePoint. That’s an essential action in SharePoint that you need to be aware of because of the following:

  • If you add any new assets to the site, they will not automatically inherit the site permissions. You will have to add them manually.
  • It is not readily apparent that you are sharing your file at a glance. In SharePoint, you can see who can access the documents by editing the document library view and including the “shared with” column.

Sharing files in Microsoft 365 is relatively easy, but many considerations are needed to maintain the security of your data. We recommend using permission groups as much as possible and avoid assigning permissions to specific users. Also, it is a best practice to create a permissions matrix for each project that details permission groups, levels, members of each group, and the assets to which each group has access.

If you find permissions management complicated and need help getting things up and running or need help with Microsoft 365, you can reach out for a free one-hour consultation here.

Keep Your Construction Data Safe with Microsoft 365 Permissions – Part 1 

Microsoft News |

The process of granting permissions in Microsoft 365 seems straightforward. Most users are familiar with Microsoft's three default permission groups: owners, members, and visitors. These three permission roles simplify permission management, but do you understand what those access levels mean? And what if you need more control over who can do what on your projects? Read on to learn how Microsoft 365 structures permissions and how to manage permissions for your construction projects effectively. 

Microsoft 365 consists of several layers of permission management. In this article, we will discuss the following two: 

  1. Microsoft 365 Admin roles
  2. Application specific roles 

In our upcoming installments in the series, we will cover SharePoint permission levels, groups, and sharing. 

Microsoft Admin roles

Admin roles are assigned from the Microsoft 365 admin center. There are many administrative roles, such as billing, licensing, and Office Apps. Most construction organizations already have a Microsoft 365 tenant administrator overseeing the administration duties. However, suppose you want separate users responsible for SharePoint or Teams administration. In that case, you must assign those admin roles to those users.

Microsoft 365 Admin center permission roles filtered for SharePoint

SharePoint Admin: This permission role would be needed if the user plans on creating/deleting SharePoint site collections and modifying their settings. This role allows the admin ability to:

  • Create and delete site collections. Note: a non-Admin can still indirectly create SharePoint sites, but they are associated with an application (e.g., Teams, Planner, etc.).
  • Manage site collections and global SharePoint settings.

Application Permissions

Each application in Microsoft 365 has some level of permissions or sharing that follows a somewhat consistent pattern. The three common roles you will find in most Microsoft 365 applications are:  

  • Owner – Typically allows users to create, edit, and delete artifacts (sites, plans, teams, etc.) and records. This role also can add and assign users/permissions and manage site-scoped features. 
  • Member – Allows users to create, edit, and delete records. A record could be a document or a line item in a SharePoint list. 
  • Visitor/Guest – Allows users to view records. They cannot add or delete records. 

An example of these roles in Microsoft Teams is below:

Permission roles in Teams
  • Owner - Team owners manage specific settings for the team. They add and remove members and guests, change team settings, and handle administrative tasks. There can be multiple owners in a team. 
  • Members - Members are the people in the team. They talk with other team members in conversations. They can view, upload, and change files. They also do the usual collaboration that the team owners have permitted. 
  • Guests - Guests are people from outside your organization that a team owner invites, such as partners or consultants, to join the team. Guests have fewer capabilities than team members or owners, but there's still much they can do. 

Next up: SharePoint Permissions

The basics of assigning permissions are simple, but what if you want to change or make permissions more granular?  

At the core of most Microsoft 365 applications is SharePoint. Data created in applications like Microsoft Teams is stored in SharePoint-named sites. So, when you create a new team, a SharePoint site is created automatically associated with the team. The same goes for Microsoft Planner when you create a plan. Microsoft Lists saves your lists to SharePoint based on the site you select. So, to modify permissions, you need to understand SharePoint permissions. We will cover SharePoint permissions in our next article. 

Meanwhile, contact us for a free one-hour consultation if you need help with Microsoft 365 permissions or setup. If you need a turnkey construction management solution for Microsoft 365, you can request a demo of Construction Viz.