SharePoint & OneDrive

OneDrive, Teams files and SharePoint document libraries look like three products. They are one storage engine wearing three faces — and every 'where is this file / who can see it' question is answered by knowing which face you're looking at.

SharePoint's permission model is elegant until someone breaks inheritance — then it becomes the tangle that oversharing and Copilot incidents grow in. The model, the trap, and how to reason about effective access.

Most access in a real tenant flows through sharing LINKS, not group membership — and one link type quietly makes content org-readable. Know the three, their scopes, and the settings that bound them.

Storage is a shared tenant pool with per-site quotas, versioning quietly eats a large share of it, and 2026 changed how it's billed. The model, the hidden costs, and the new pricing you should plan around.

SharePoint has four admin planes with heavy overlap and one sharp trade-off: the automation that reaches everything (PnP) wants a permission scope you should think hard about. Route tasks correctly and know the auth story.

The #1 SharePoint incident of the Copilot era isn't a breach — it's Copilot answering with a file the asker could always open. The remediation toolkit is SharePoint Advanced Management, unlocked by one Copilot licence, and here's the staged runbook.

The sharing-links concept named the levers; this one names them precisely — the exact `Set-SPOTenant` properties, their allowed values, and the tenant-caps-the-site rule that makes these the org-wide dials serv365 versions nightly.

Sensitivity labels apply at two levels that people constantly confuse — the site container and the individual file — and only one of them encrypts. Knowing which enforces what is the difference between a real Copilot boundary and a false sense of one.

Every Team, Planner plan and self-service request spawns a site, and sites are born easily but die reluctantly. The controls that govern the whole arc — creation, ownership, inactivity, archive, and the read-only tier — before sprawl becomes the estate.

A OneDrive is a SharePoint site with exactly one owner, and its whole story — birth on first use, per-user quota, and the clock that starts ticking when the owner leaves — is where the 'the file died with the leaver' incident is born.

The OneDrive sync client makes cloud content look like local files through Files On-Demand placeholders — until a conflict, a path-length limit or a full disk turns it into the most common end-user support call in Microsoft 365.

Known Folder Move redirects Desktop, Documents and Pictures into OneDrive so a lost laptop isn't a lost user — but it's sync, not backup, and treating it as backup is how ransomware or a bad delete propagates straight to the cloud.

SharePoint search is a crawl-index-query pipeline with one safety net — security trimming — bolted on at query time. Understanding its latency and its trimming explains both 'I can't find my new file' and, more importantly, what Copilot grounds on.

Content types, site columns and the managed metadata term store are the information-architecture layer that makes content findable and governable. The payoff is understanding why folders collapse at scale and metadata doesn't — and the 5000-item wall behind it.

The modern intranet is communication sites, modern pages and news — a broadcast, author-and-reader model distinct from the collaborative team site. How pages are built, how news reaches people, and where Viva Connections fits as the front door.

Hub sites connect many flat sites into a family with shared navigation, branding and search — the modern answer to the old subsite hierarchy. Understanding hubs is understanding why SharePoint Online wants a flat, associable structure, not a tree.

Retention on SharePoint is enforced by a hidden library that quietly captures anything you edit or delete while a retention obligation is in force. Understanding the Preservation Hold Library explains deletion timing and the 'storage didn't drop' surprise.

Version history and the two-stage recycle bin are SharePoint's built-in recovery — and the same feature that quietly multiplies storage. Knowing the limits, the 93-day window and the point-in-time restore is knowing your realistic recovery envelope.

eDiscovery over SharePoint content turns on one mapping question — which sites and OneDrives hold a custodian's data — and one trap: content the index couldn't read. Get the mapping and the indexing caveat right and the collection is defensible.

Records management layers immutability and defensible disposal onto retention: a label can declare content a record — locking it against edit or delete — and route its end-of-life through a human disposition review. The tiers, the locks, and the traps.

Sharing with someone outside the tenant threads through several independent switches that ALL must permit it, creates or reuses an Entra B2B guest object, and — for recipients without an account — verifies them with a one-time passcode. The full chain.

Conditional Access lets you allow SharePoint from anywhere but clamp what an unmanaged device can do — browser-only, no download, no sync. It's the pragmatic middle between blocking BYOD entirely and letting corporate data land on any laptop.

DLP scans SharePoint and OneDrive content for sensitive information and acts on it — blocking sharing, warning users, restricting access. The catch is timing and coverage: DLP sees what the index sees, so it protects indexed content, not the moment of upload.

SharePoint and OneDrive survive ransomware not through backups but through version history and a point-in-time rewind — within a 30-day window. Knowing that envelope, and where Microsoft 365 Backup extends it, is knowing your true recovery position.

PnP PowerShell reaches inside sites where the SPO cmdlets can't — provisioning structure, enumerating item permissions, bulk operations — but that reach usually rides on a powerful, write-capable, all-sites permission you should grant deliberately.

Migrating to SharePoint Online is mostly a fidelity problem: the tools move bytes reliably, but permissions, path lengths, versions and metadata are where migrations bleed accuracy. Know the engine and, more importantly, what it can and can't preserve.

Monitoring SharePoint well means watching a few high-signal things — sharing-setting drift, storage and site growth, and the audit-log sharing operations — and turning nightly snapshots into dated alerts. This is the change-intelligence loop serv365 is built on.