External sharing in Sharepoint
- Christopher Dahlin (Unlicensed)
When sharing a document with external users (or internal users for that matter), the default settings in SharePoint will often lead to breaking of inherited permissions on the document.
The main problem with this is that if the permissions for the document library is changed later, these permissions will not propagate to the documents with broken inheritance.
There is no way to prevent user with Owner/Full Control permissions to break inheritance if they really want to.
There is however steps to be taken to prevent other users from breaking inheritance and making it more difficult for owners to break inheritance.
Changing Access Request Settings
When sharing a document the sharing box look like this:
The user is able to change the way the document is shared:
When sharing in this manner, the inheritance will break.
You can prevent users with members permissions to break inheritance by doing the following:
Go to Site Settings -> Site Permissions -> Access Request Settings
By removing the checkmark for “Allow members to share the site and individual files and folders” ordinary users will be prevented from breaking inheritance anywhere on the site.
The sharing box will look like this:
If the user tries to manually add an email address of an external user the following error page appears:
Changing default settings for sharing
If the default setting for sharing is changed to “People with existing access”, it will make it more difficult for users with Owner/Full Control to break inheritance.
The setting is changed in SharePoint admin center and can only be accessed with a SharePoint Admin user.
In SharePoint Admin Center chose Sites -> Active sites -> The site to change -> Settings à More sharing settings
Default sharing link type is usually set to “Anyone with the link”.
Remove the checkmark and choose “People with existing access” and Save.
With this setting the inheritance will not break as the sharing will be with users that already have access and no change in permissions is necessary.