This is an extremely long subject that warrants a series of blogs. High-level though :
Sites are made up of lists, libraries and pages – and variations of those in those 3 main categories. If you an old SharePoint implementation, you’ve probably got loads of subsites too. They follow the same pattern; each site has its own lists, libraries and pages.
All lists and libraries inherit permissions from the site level. That means, whomever you have in the default Members, Owners, Visitors groups, has access to all content the site. But you can break permissions on subsite level, list / library level, folder level, and document level to give access to different people on certain content.
To manage / troubleshoot / understand a site’s permissions, click on Settings > Site Permissions > Advanced Permissions.
If you see a yellow bar on top with ‘Show These Items’, you know you have unique permissions on your site – in other words, not everything is the same as the site level.
Click on the ‘Manage Permissions’ link on each one to see what’s going on in there.
Once in the list / library that is unique, there may be additional items inside it that are unique. Click ‘Show These Items’ again.
That will list all the documents that are unique.
And clicking on ‘Manage Permissions’ shows you who access to it and how.
If it’s wrong, it can be reset using the ‘Delete Unique Permissions’ in the ribbon.
WARNING
If you delete the unique permissions on a document, whoever had access to it before will get a 404 not found error if they click the link sent to them for it. Also think about this on buttons, quick links and images. If you’ve embedded a sharing link and then delete it in the screen above, users will get an error.
HEADS UP
Every time you share a document, if you don’t change the setting to ‘People with Existing Access’, it breaks permissions on the library and the document. Using any other setting in here breaks the permissions.
IT PRO TIP
You can run a PowerShell script per site collection to change the default sharing option to ‘People with Existing Access’ :
Set-SPOSite -identity
https://yourtenantname.sharepoint.com/sites/yoursitename -DefaultLinkToExistingAccess 1
