SharePoint permissions: inheritance done right, and why AI makes it urgent for Carolina businesses

Across the Carolinas, businesses in Charlotte, Raleigh-Durham, Greenville, and Wilmington are moving fast on AI. Copilot pilots are starting in finance teams, manufacturers are summarizing quality records, and healthcare groups are drafting patient communications. Every one of these tools has the same dependency: they work from the content a person is allowed to see in SharePoint and OneDrive.

That makes SharePoint permissions the control point for AI. Get inheritance right and Copilot is useful and safe. Get it wrong and AI will faithfully surface whatever your permissions allow, including the salary spreadsheet someone shared with “Everyone except external users” in 2021 and forgot about.

How SharePoint inheritance actually works

SharePoint permissions flow down a hierarchy: site, then library or list, then folder, then individual item. By default, each level inherits from its parent. Add a person to the site’s Members group and they can reach everything beneath it unless something breaks the chain.

Breaking inheritance means giving a folder or file its own unique permissions. It is a legitimate feature. It is also the source of most permission problems we find in audits, because it is easy to do, invisible to most users, and painful to unwind.

Three terms matter:

Permission groups. Every site has Owners, Members, and Visitors groups. For a Microsoft 365 group connected site, these map to the group owners, group members, and a separate visitors group.

Direct and sharing link access. When someone clicks Share on a file, SharePoint often creates a sharing link or a unique permission entry. These do not show up in the site permissions page, which is why site owners believe their site is locked down when it is not.

Unique permissions. Any item with its own permission set. Each one is an exception that someone has to remember.

The sprawl pattern we see in the region

When we review SharePoint environments for Carolina mid-market companies, the story is remarkably consistent. A site starts clean. Over three years, well-meaning employees share individual files, project leads break inheritance on folders to hide a bid, and an administrator adds a user directly to a library to fix a ticket quickly.

The result is hundreds or thousands of items with unique permissions. Nobody can answer the question “who can see this?” without opening each one. Microsoft also documents practical limits here: large numbers of uniquely permissioned items degrade performance, and Microsoft recommends keeping the count well under the supported thresholds.

Rules for inheritance done right

1. Grant access to groups, never to individuals. Use Microsoft 365 groups or Entra ID security groups. When a person changes roles, you change group membership once instead of hunting through sites.

2. Keep inheritance on by default. Treat a broken inheritance chain as an exception that requires a reason. If the reason is “this content is sensitive,” the better answer is usually a separate site.

3. Use a new site instead of a locked-down folder. If HR, legal, or executive content needs different access, give it its own site with its own owners. A site boundary is easy to explain, audit, and apply a sensitivity label to. A folder with unique permissions three levels deep is not.

4. Limit sharing links. In the SharePoint admin center, set the default link type to “Specific people” or “People in your organization” rather than “Anyone.” Set link expiration for external sharing. Most accidental exposure comes from links, not from groups.

5. Name two owners per site. An orphaned site with no active owner is a permissions problem waiting to happen. Two owners mean someone is always available to approve access requests and review membership.

6. Review on a schedule. Use access reviews in Entra ID for groups and the SharePoint site access review reports for oversharing. Quarterly is a sensible default for sensitive sites, twice a year for the rest.

Where AI changes the stakes

Microsoft 365 Copilot respects existing permissions. It does not bypass them. That is the right design, and it is also the problem: Copilot makes overshared content easy to find.

Before AI, an overshared file was protected by obscurity. Nobody knew it existed or where to look. Ask Copilot “what are the compensation bands for senior engineers?” and a file that is technically open to the whole company can appear in seconds.

For Carolina businesses in regulated sectors, the exposure is concrete:

• Healthcare and life sciences organizations handling PHI need access limited to those with a clinical or operational need.
• Defense and aerospace suppliers working toward NIST 800-171 or CMMC need controlled unclassified information confined to the right people and locations.
• Financial services firms have client data and examination records that should never be one prompt away from every employee.

None of these are Copilot problems. They are permission problems that Copilot makes visible.

A practical remediation sequence

Step 1: Find the oversharing. Use SharePoint Advanced Management and the Data Access Governance reports to identify sites shared with large groups, “Everyone except external users,” or many sharing links. Start with the sites most likely to hold sensitive content.

Step 2: Classify the sites. Decide which sites are public to the company, which are team-restricted, and which are sensitive. Apply Microsoft Purview sensitivity labels so the classification travels with the content.

Step 3: Reset inheritance where it was broken without reason. For folders and files with unique permissions, document why. If there is no good reason, restore inheritance. SharePoint lets you delete unique permissions and inherit from the parent, but test on a copy first because it changes who has access immediately.

Step 4: Move genuinely sensitive content to its own site. Create the site, assign two owners, apply the label, and migrate the content. Retire the old unique-permission folder.

Step 5: Restrict what Copilot can use while you clean up. Features such as Restricted Content Discovery let you keep specific sites out of Copilot and organization-wide search while remediation is in progress. This is a stopgap, not a substitute for fixing the permissions.

Step 6: Set a steady-state review. Name the owner for each site, schedule the reviews, and add a short permissions section to your SharePoint governance plan.

Common mistakes to avoid

• Fixing oversharing by turning off Copilot instead of fixing permissions. The exposure through search remains.
• Breaking inheritance on a library to “temporarily” restrict access, then never restoring it.
• Adding individuals to the site owners group because it is the fastest way to resolve a request.
• Assuming a Teams private channel is a security boundary for everything. Private channels have their own SharePoint site, which is useful, but you still need owners and reviews.

The payoff

Clean permissions do more than reduce risk. They make AI better. When access reflects real roles, Copilot returns relevant content instead of noise, and compliance teams can sign off on rollout with confidence. The Carolina companies seeing the best results from AI are not always the ones spending the most. They did the unglamorous work on identity, permissions, and information architecture first.

---

Devsoft Solutions helps businesses across North and South Carolina audit SharePoint permissions, design governance, and prepare their Microsoft 365 environment for Copilot. If you want a clear picture of who can see what today, get in touch.