Permission Levels
Common Use Cases
- Standard site access: Owners, Members, and Visitors mapped to default levels
- Read-only audiences: Read or View Only for reference content
- Contributor roles: Contribute for adding items without managing the site
- Restricted viewing: a custom level that blocks download or copy
- Delegated administration: Full Control for trusted site administrators
- Project teams: tailored levels for mixed editor and reviewer groups
Default Permission Levels
- Full Control: every permission, assigned to the Owners group
- Edit: add, edit, and delete lists plus items, assigned to Members
- Contribute: add and edit items but not manage lists
- Read: view pages, items, and documents without changing them
- View Only: view content but not download files
- Limited Access: behind-the-scenes access to a single shared item
Details
- Feature Category: Sharing & Permissions
How It Works
- Bundled permissions: each level is a set of more than thirty individual rights
- Three categories: site, list, and personal permissions combine per level
- Attached to groups: a level is granted to a SharePoint group, not a person
- Inheritance by default: subsites and lists inherit the site’s assignments
- Limited Access is automatic: SharePoint grants it to reach shared items
- Stored per site collection: levels are defined at the site collection root
Custom Permission Levels
- Create your own: copy a level and adjust the permission checkboxes
- Read without download: remove the relevant rights for a view-only audience
- Cannot exceed parent: a level cannot grant more than the site allows
- Edit a copy, not a default: changing a default level affects everyone with it
- Name clearly: descriptive names prevent confusion later
- Site collection scope: custom levels apply within their site collection
Limits and Nuances
- Do not edit defaults: alter a copy rather than the built-in levels
- Limited Access can break: removing it can hide shared items
- Unique permissions multiply: breaking inheritance adds management overhead
- View Only is not airtight: screenshots and other routes still exist
- Group-based is best: assigning levels to individuals gets messy fast
- Classic roots: the model predates modern sites and still underpins them
Common Questions About Permission Levels
What is a permission level in SharePoint?
A permission level is a named bundle of individual permissions that defines what someone can do on a site – view, add, edit, delete, or manage. Instead of assigning dozens of granular rights individually, SharePoint groups them into levels like Full Control, Edit, Contribute, and Read, and attaches a level to a SharePoint group. The group membership plus its level determines each person’s effective access.
What are the default SharePoint permission levels?
The common defaults are Full Control, Edit, Contribute, Read, and View Only, along with the automatic Limited Access. In a modern site, Owners receive Full Control, Members receive Edit, and Visitors receive Read. Full Control can do anything, Edit can manage lists and items, Contribute can add and edit items, Read views without changing, and View Only views without downloading.
What is the difference between Edit and Contribute?
Both let a user add and change items, but Edit goes further: it can create, edit, and delete entire lists and libraries, not just the items inside them. Contribute is limited to adding and editing items and documents within existing lists. Members get Edit by default, which is often broader than necessary, so some organizations switch Members to Contribute to prevent accidental list changes.
Can I create a custom permission level?
Yes. You copy an existing level and adjust the individual permission checkboxes to fit your need – a common example is a Read level with the download right removed for view-only content. Custom levels are defined at the site collection level and cannot grant more than the site itself allows. Avoid editing the built-in levels directly, since that changes access for everyone who already has them.
What is Limited Access and why does it appear?
Limited Access is a behind-the-scenes level SharePoint assigns automatically so a user can reach a specific item or library they were given access to, without seeing the rest of the site. You rarely assign it yourself, and removing it can unexpectedly break access to shared content. It exists to make item-level sharing work, which is why it shows up whenever unique permissions are involved.
When should I bring in help with permissions?
Permission levels are simple in theory but easy to tangle once inheritance is broken and access is granted item by item. Greg Zelfond, the consultant behind LookBook 365, designs permissions around SharePoint groups and the standard levels, keeping unique permissions to a minimum so access stays understandable a year later. When a site’s security has become a web of one-off grants, that structured approach is what untangles it.