The model, cleanly
Three layers compose an access decision:
- Principals — who: individual users, Microsoft 365 Groups, security groups, and SharePoint's own site groups (Owners, Members, Visitors by default).
- Permission levels — what: named bundles of rights (Full Control, Edit, Contribute, Read, and custom ones). A level is granted to a principal on a securable object.
- Securable objects — where: site → library/list → folder → item, each inheriting from its parent by default.
The clean default: a site's Members group has Edit, Visitors have Read, everything inherits down. In this state, access is reasonable and auditable — you can answer 'who can see this' by reading the site's groups.
Where it goes wrong: broken inheritance
The moment someone shares a single file/folder differently ('just send it to this one person'), SharePoint breaks inheritance on that item and gives it UNIQUE permissions. Now the site's groups no longer describe reality for that item. Do this a few thousand times over years and you get the estate nobody can reason about — which is exactly the substrate Copilot reads under the asker's effective permissions (the Copilot oversharing concept). Broken inheritance is not a bug; it's the accumulated cost of a thousand convenient shares.
Effective access: what actually decides
A user can open an item if ANY path grants it: direct grant, a site-group membership, a Microsoft 365 Group membership tied to the site, a sharing link whose scope includes them (next concept — the biggest surprise source), or a special principal like 'Everyone except external users'. Effective access is the UNION — which is why 'they're not in the Members group but can still open it' is normal, not mysterious.
What to watch (proofs)
- Effective access for one user+item: the site's Check Permissions tool (Site Settings → Site Permissions → Check Permissions) — names the exact grant path; the answer to every 'why can they' ticket.
- Broken-inheritance inventory: SharePoint Advanced Management's data-access governance reports surface items with unique permissions at scale (the oversharing concept) — the map of the tangle.
- Site group membership:
Get-SPOSiteGroup -Site <url>— the site's intended access; deltas from reality are the unique-permission sprawl. - The 'Everyone except external users' claim: search site permissions for it — an org-wide readability grant people forget they made.