SharePoint: Sites, Libraries & Permissions
SharePoint is where your organisation's documents live. Sites, libraries, and permissions — the three things every admin must understand, especially now that Copilot reads SharePoint data.
What is SharePoint?
SharePoint is your organisation’s filing cabinet — except it’s in the cloud, searchable, and Copilot can read it.
In the old days, documents lived in shared folders on a server. SharePoint replaces that with sites (like departments), libraries (like drawers), and files (the actual documents). The big advantage: you control exactly who can see what.
This matters enormously for Copilot. Since Copilot reads your SharePoint data through Microsoft Graph, whatever users can access in SharePoint, Copilot can access too. If your permissions are messy, Copilot will surface sensitive documents to the wrong people.
SharePoint objects: sites, libraries, folders
Sites — the top-level containers
| Site Type | Purpose | Created By | Example |
|---|---|---|---|
| Team site | Collaboration for a group/department | M365 Group or Teams team | Marketing team site |
| Communication site | Broadcast information to a wide audience | Site creator (no group) | Company intranet, announcements |
Every Teams team automatically gets a SharePoint team site — the “Files” tab in Teams IS a SharePoint document library.
Document libraries — where files live
- A library is a collection of files within a site
- Each site can have multiple libraries (e.g., “Project Plans”, “Contracts”, “Templates”)
- Libraries support versioning (track changes), metadata (tags), and check-in/check-out
Folders — organise within libraries
- Folders are optional — some organisations use metadata instead
- Folders inherit the library’s permissions by default, but can have custom permissions
SharePoint roles and permissions
This is critical for the exam — and for Copilot security:
| Feature | What They Can Do | Typical User |
|---|---|---|
| Site Owner | Full control — manage permissions, settings, and structure | Department manager, IT admin |
| Site Member | Add, edit, and delete content | Team members, contributors |
| Site Visitor | Read only — view content but can't change it | Broader org, external stakeholders (with guest access) |
Permission inheritance — how it flows
Permissions flow downward in SharePoint:
Site → Library → Folder → FileBy default, a library inherits the site’s permissions. A folder inherits the library’s permissions. A file inherits the folder’s permissions.
But at ANY level, you can break inheritance and set custom permissions. For example:
- HR site → everyone is a Member
- HR site → “Salary Reviews” library → only HR managers have access (inheritance broken)
⚠️ Copilot implication: If a file’s permissions allow User A to see it, Copilot will surface it when User A asks a question. Broken inheritance is how you protect sensitive files from being found by Copilot.
The SharePoint admin center
Key areas in admin.sharepoint.com:
| Section | What You Manage |
|---|---|
| Active sites | All sites in the tenant — create, delete, manage settings |
| Sharing | External sharing policies — who can share with people outside the org |
| Storage | Storage quotas per site and tenant-wide limits |
| Access control | Device-based access, network location restrictions |
| Settings | Default sharing link type, site creation permissions |
Scenario: Clearfield Council's SharePoint governance
Clearfield Council has strict data governance requirements. Director Chen configures:
- External sharing = disabled — no document sharing with people outside the council
- Storage quotas — 25 GB per department site, 100 GB for the legal archive
- Access control — only managed devices can access SharePoint (unmanaged personal devices blocked)
- Default sharing — set to “People in your organisation” (not “Anyone with the link”)
These settings prevent the most common data leakage scenarios — especially important when Copilot is deployed, since it inherits the same access controls.
🎬 Video walkthrough
Flashcards
Knowledge Check
Northwave's HR department stores salary review documents in a SharePoint library. They want only HR managers to access these files, but the rest of the HR site should be accessible to all HR staff. How should Maya configure this?
After deploying Copilot, Northwave discovers that interns can ask Copilot about board meeting notes stored in SharePoint. What is the ROOT cause?
Next up: Microsoft Teams — teams, channels, and policies in the Teams admin center.