SharePoint Groups

SharePoint groups are the access containers that live inside a single site. Every site ships with three by default - Owners, Members, and Visitors - each tied to a permission level: full control, edit, and read. Instead of granting permissions one person at a time, you add them to the right group and they inherit that access. A SharePoint group is site-scoped: it belongs to the site that owns it, unlike a Microsoft Entra group that spans the whole directory. Understanding these three default groups, and resisting the urge to invent dozens more, is the heart of clean SharePoint permissions.

Access Requests, Microsoft 365 Group, Microsoft Entra Groups, Permission Levels, Site Members, Site Owners, Site Visitors

Default access tiers: Owners, Members, and Visitors out of the box
Granting edit rights: adding contributors to the Members group
Read-only audiences: placing viewers in the Visitors group
Site administration: reserving the Owners group for site admins
Custom groups: an occasional extra group for a special need
Nesting directory groups: adding an Entra group into a SharePoint group

Benefits

Simple model: three tiers cover most needs
Permission levels: each group maps to a clear access level
Site-scoped: groups belong to the site that uses them
Owner-managed: site owners control membership
Less sprawl: fewer, clearer groups are easier to govern
Works with Entra: directory groups can be nested inside

Details

Feature Category: Sharing & Permissions

How It Works

Three default groups: Owners, Members, Visitors per site
Mapped to levels: full control, edit, and read respectively
Add people or groups: members can be users or Entra groups
Site permissions page: groups are managed in site settings
Inherited access: members get the group permission level
Custom groups possible: additional groups for special cases

Limits and Nuances

Site-scoped only: a SharePoint group does not span other sites
Not the same as Entra groups: directory groups are managed elsewhere
Group sprawl: too many custom groups become hard to manage
Group-connected sites: Microsoft 365 group membership can override the model
Owners are powerful: full control should be limited
Unique permissions: breaking inheritance complicates the picture

Common Questions About SharePoint Groups

What are SharePoint groups?

SharePoint groups are permission containers that live inside a single site. Every site comes with three by default – Owners, Members, and Visitors – and each maps to a permission level: full control, edit, and read. Rather than granting access person by person, you add users or directory groups to the right SharePoint group, and they inherit that level of access to the site.

What are the default SharePoint groups?

The three default groups are Owners, Members, and Visitors. Owners have full control and administer the site, Members have edit rights to add and change content, and Visitors have read-only access. These three tiers cover the vast majority of needs, which is why a clean permission model usually means using them well rather than inventing many custom groups.

How do SharePoint groups differ from Entra groups?

A SharePoint group is scoped to one site and managed by its owners, while a Microsoft Entra group lives in the central directory and can be used across many sites and services. They complement each other: a common pattern is to nest an Entra security group inside a SharePoint group, so central identity drives membership while the SharePoint group sets the access level on that site.

Can I add a directory group to a SharePoint group?

Yes, and it is a recommended pattern. You can add a Microsoft Entra security group or a Microsoft 365 group as a member of a SharePoint group. That way the directory group controls who the people are, managed centrally by IT, and the SharePoint group controls what level of access they get on the site. It keeps membership scalable and permissions clear.

Should I create lots of custom SharePoint groups?

Usually not. The three default groups handle most scenarios, and creating many custom groups leads to sprawl that is hard to track and audit. A custom group makes sense for a genuine, lasting need, but inventing a group for every small variation tends to create confusion. Fewer, clearer groups are easier to govern over time.

How should I manage SharePoint group membership?

Keep the Owners group small, use Members for contributors, and Visitors for read-only audiences, adding directory groups where access should follow the org chart. Greg Zelfond, the consultant behind LookBook 365, favors this lean model because it stays understandable as a site grows, while breaking inheritance and spinning up custom groups only when a specific requirement truly demands it.