To Share or not to Share? A must-read for SharePoint Site owners
Just like Hamlet contemplated death and suicide in the famous Shakespeare play with the famous “To be or not to be,” SharePoint Site Owners must also make a very important, though less dramatic decision. The decision on whether To Share or not to Share (allow or disallow sharing of the site and its contents). Let me explain…
What’s the “problem” with Sharing?
As I have documented extensively in the previous post, by default, SharePoint sites are set up for easy sharing and collaboration. In pure English, what this means is that anyone from Members group (with Edit permission level) can easily share the whole site, files and folders with other users, inside or outside of the organization (without the oversight of the Site Owner). Here is the proof…
I am a Site Owner, and I added Mary (who is part of my team) as a Member of the site (by default she will have Edit privileges).
Mary then clicks Share or Site Permissions and decides to invite John (who is from entirely another department!).
Once she clicks Add button above, John ends up in the Members Group! And I, the Site Owner have no idea this happened! John now can add/edit/delete content and web parts, just as Mary could! What the @#$%?
Visitors can Share too!
Here is another situation for you. I am a Site Owner and do not have anyone in the Members group. Instead, I added Mary as a Visitor with read-only access.
Mary then clicks on Share Button in the upper-right-hand corner of the site.
She then invites John again (she must have a crush on him or something) and clicks Share.
In this instance, I, as a Site Owner will get an email telling me that Mary wants to share the site with John.
If I click Accept, I will see this screen and if I am in a hurry and click Approve, John will be added to the Members Group and will have Edit privileges!!!
So we end up with a situation where a Visitor to the site added another user who became a Member!
How to disable sharing
If you find the above scenarios disturbing, there is a way to prevent this through Site settings.
- Gear icon > Site permissions
- Click on Advanced permissions settings
- Click on Access Request Settings in the ribbon
- You will notice that by default all checkboxes are checked. The 1st one controls whether or not you allow file or folder sharing. The 2nd one – whether users can share the whole site and the 3rd one – whether you want to allow Access requests (emails to be sent to the Site Owner with a request to approve or reject)
- If I uncheck all 3 and click OK, I pretty much disable any sharing (I, as a Site Owner, will be the only one who can add new users to the site)
- Here is a message Mary now gets when she tries to share the site with her sweetheart, John
- And since we disabled file and folder sharing above as well, here is a screen Mary will get when trying to share a file or folder.
So, to Share or not to Share?
Back to the original question if this post. The answer is – it depends. If you have a department site or some private team site (i.e., executives), you might want to control security as a Site Owner and not allow the decision to be determined by team members. So, in this case, you will disable site and file/folder sharing or at least the whole site sharing. On another hand, if your site is a project site and people come and go, and you want to reinforce a collaborative environment, as a project manager/site owner you might want to leave the sharing on.
Ellen Van Aken published an excellent blog post about access requests. I suggest you read it!
Need SharePoint Help?
Hourly consulting, training and configuration services are availableLearn More