Skip to main content

Secure SharePoint Permissions with Scope Groups

This guide provides IT administrators and SharePoint site owners with procedures for configuring SharePoint Online permissions using Cloud Scope Groups (CSGs) and File Scope Groups (FSGs). The goal is a secure, modular permissions model that adheres to least privilege and enhances Copilot readiness.

Who Should Use This Guide​

  • SharePoint Site Owners — Responsible for site content and access
  • Departmental IT Staff — Create, configure, and support SharePoint sites
  • Entra ID Groups Administrators — Create and manage scope groups within AUs
  • Technology Services SharePoint Administrators — Enforce standardized approach

Why This Matters​

BenefitDescription
Data SecurityProtect sensitive data from unauthorized access
GovernanceEasier to audit who has access
ComplianceSupport FERPA, HIPAA, and other regulations
ScalabilityReduce complexity as sites and users grow
Copilot ReadinessAI tools only access appropriately permissioned data

This guide promotes a Zero Trust mindset: always verify, grant least privilege.

Prerequisites​

RequirementDetails
Entra ID RoleGroups Administrator for your Administrative Unit (AU)
Understanding of AUsCSGs/FSGs must be created within the correct unit AU
Naming ConventionsFollow University standards for scope groups

Core Concepts​

SharePoint Permission Levels​

LevelCapabilities
ReadView pages, items, download documents
ContributeView, add, update, delete items
EditAdd, edit, delete lists; manage list permissions
Full ControlAll permissions

SharePoint Groups vs. Entra ID Scope Groups​

TypeScopeUsage
SharePoint GroupsExist only within a specific siteContainer for permission level assignment
CSG/FSG (Entra ID)Exist across the organizationMembers added to SharePoint groups

Our standard: Add CSGs/FSGs as members of SharePoint groups instead of individual users.

Scope Group Types​

TypePurposeNaming Convention
☁️ CSGGrants access to entire sitesCSG - [FAMIS] - [Site] - [Access Level]
🗂️ FSGManages granular file/folder permissionsFSG - [FAMIS] - [Library/Folder]

Examples:

  • CSG - VPOP - ResearchHub - Owners
  • FSG - VPOP - ResearchHubDocs - SensitiveContracts - Edit
Avoid "Everyone except external users"

This built-in group grants access to ALL internal users. Never add this group to site Members or Visitors for departmental/team sites.

Procedure​

Step 1 – Create Scope Groups (AU Groups Administrator)

The Delegated Model​

  1. IT creates the container — AU Groups Admin creates CSG/FSG in correct AU
  2. IT assigns ownership — Customer representative becomes group owner
  3. Customer manages membership — Owner adds/removes users
  4. Site Owner uses the group — Adds CSG/FSG to SharePoint groups

Creation Process​

  1. Receive Request: Customer contacts Unit IT with:

    • Group Type (CSG/FSG)
    • FAMIS Code
    • Purpose/Name
    • SharePoint URL (for CSGs)
    • Designated owner(s)

  2. Create in Entra Admin Center:

    • Navigate to your Administrative Unit
    • Groups > + New group
    • Type: Security
    • Name: Follow naming convention
    • Description: Include SharePoint URL (for CSGs)
    • Membership type: Assigned

  3. Assign Customer Ownership:

    • Navigate to new group
    • Owners > + Add owners
    • Add designated customer representative(s)
    • Notify owners they can manage membership via My Groups portal
Step 2 – Configure SharePoint Site (Site Owner)

Site Type Considerations​

Site TypeAccess Control
Private Team SiteOnly M365 group members have access
Public Team Site⚠️ Auto-adds "Everyone except external users" — must remediate
Communication SiteStandalone; controlled by SharePoint groups only
For Public Team Sites

Immediately go to Advanced permissions settings → Site Members → Remove "Everyone except external users"

Configuration Steps​

  1. Access Advanced Permissions:

    • Settings gear > Site permissions > Advanced permissions settings

  2. Configure Each SharePoint Group:

    • For [SiteName] Owners, [SiteName] Members, [SiteName] Visitors:
      1. Click on the group
      2. Remove all default members (especially "Everyone except external users")
      3. Add your pre-created CSG for that role
      4. Verify correct permission level

  3. Configure External Sharing:

    • Set via SharePoint Admin Center
    • Use "New and existing guests" (controlled) or "Only people in your organization"
    • Avoid "Anyone" links

  4. Implement FSGs (Only If Needed):

    • Navigate to library/folder requiring unique permissions
    • Stop Inheriting Permissions
    • Remove inherited groups as needed
    • Grant Permissions → Add FSG with appropriate level
Document Broken Inheritance

Track where inheritance is broken and which FSGs are in use for ongoing management.

Step 3 – Ongoing Management

Regular Reviews​

RoleReview TaskFrequency
Site OwnerReview SharePoint group membershipsQuarterly
CSG/FSG OwnerReview group membershipQuarterly
Security TeamAudit broad sharing linksOngoing

User Training Topics​

  • Managing CSG/FSG membership via My Groups portal
  • Requesting new scope groups from Unit IT
  • Using "Specific people" links for secure sharing
  • Risks of "Anyone" links

Troubleshooting​

IssueSolution
User can't access siteVerify user is in correct CSG; verify CSG is in SharePoint group; allow sync time
Site is "too open" / Copilot surfaces unexpected dataCheck for "Everyone except external users" in SharePoint groups; remove and replace with specific CSG
User needs temporary accessCSG owner adds user temporarily, then removes