SharePoint Permission Levels Explained: Full Control to View Only

SharePoint permission levels

A permission level is a named bundle of permissions that you give to a SharePoint group or a person. The defaults are Full Control, Design, Edit, Contribute, Read, Limited Access, Web-Only Limited Access, Approve, Manage Hierarchy, Restricted Read and View Only. By default the Owners group has Full Control, the Members group has Edit and the Visitors group has Read.

This page lists each default level, shows what the common ones allow, and explains inheritance and the rules for changing them. It follows Microsoft's documentation on permission levels.

The default permission levels

Permission level	What it allows	Default group, where Microsoft names one
Full Control	All available SharePoint permissions. It cannot be customized or deleted	Owners
Design	Create lists and document libraries, edit pages, and apply themes, borders and style sheets	No group by default
Edit	Add, edit and delete lists, and view, add, update and delete list items and documents	Members
Contribute	View, add, update and delete list items and documents	-
Read	View pages and items in existing lists and libraries, and download documents	Visitors
Limited Access	Lets a person browse to a page or library to reach one specific item when they cannot open or edit anything else. It grants no additional permissions	Assigned automatically
Web-Only Limited Access	A variant of Limited Access that enables access to the web object only	-
Approve	Edit and approve pages, list items and documents	Approvers
Manage Hierarchy	Create sites and edit pages, list items and documents	Hierarchy Managers
Restricted Read	View pages and documents, but not historical versions or user permissions	-
View Only	View pages, items and documents. Documents with a server-side file handler open in the browser but cannot be downloaded	-

Microsoft notes that you can change any default level except Full Control and Limited Access. SharePoint assigns Limited Access automatically when you give someone access to a single item, and you cannot assign it directly to a user or group.

What the common levels can do

Permission	Full Control	Design	Edit	Contribute	Read	Approve	Manage Hierarchy	View Only
Manage Permissions	Yes	-	-	-	-	-	Yes	-
Create Subsites	Yes	-	-	-	-	-	Yes	-
Add and Customize Pages	Yes	Yes	-	-	-	-	Yes	-
Manage Lists	Yes	Yes	Yes	-	-	-	Yes	-
Add, Edit and Delete Items	Yes	Yes	Yes	Yes	-	Yes	Yes	-
Approve Items	Yes	Yes	-	-	-	Yes	-	-
Delete Versions	Yes	Yes	Yes	Yes	-	Yes	Yes	-
View Versions	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
View Items and Pages	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Open Items	Yes	Yes	Yes	Yes	Yes	Yes	Yes	-

Permission levels and SharePoint groups

Permission levels work with SharePoint groups. You put related permissions together into a permission level, then assign that level to a group, which is a set of people who all have the same level. A team site includes the Owners, Members and Visitors groups automatically. A publishing portal adds groups such as Approvers, Designers and Hierarchy Managers. Which groups and levels you see can differ depending on the site template and on whether an administrator created unique permissions.

For communication sites, Microsoft recommends using the built-in SharePoint groups. For team sites, it recommends managing permissions through the associated Microsoft 365 group. SharePoint RBAC explained covers roles and setup, and SharePoint document library security covers permissions inside libraries.

Inheritance

By design, the sites and content in a site collection inherit the permissions of the root site.

• A site collection administrator sets permissions for the root site of the whole collection.
• A site owner can change a site's permission settings, which stops inheritance for that site.
• Lists and libraries inherit from their site, and an owner can stop inheritance and set their own permissions.
• List items and library files inherit from their list or library, and someone with control of the list can stop inheritance for a specific item.

Sharing a document or item with someone who does not have access interrupts inheritance for it. In that case SharePoint stops inheritance on the document automatically.

Two groups worth knowing

Microsoft 365 subscriptions create a security group called Everyone except external users that contains every person you add to the directory except explicit external users. It is added to the Members group automatically on modern team sites with Public privacy. On modern team sites created as Private, that group cannot be granted any permissions and people must be granted access explicitly. By default, site owners and members can add new users to the site. How a SharePoint access request works covers the request side.

Custom levels and dependent permissions

You can create your own level when the defaults do not fit. SharePoint permissions can depend on one another, so selecting a permission also selects the ones it needs, and clearing one clears the ones that depend on it. Open is the only permission with no dependency, and every other permission depends on it. Microsoft's tip for testing a custom level is to clear Open, which clears all the others.

Frequently asked questions

What are the permission levels in SharePoint?

The defaults are Full Control, Design, Edit, Contribute, Read, Limited Access, Web-Only Limited Access, Approve, Manage Hierarchy, Restricted Read and View Only.

What permission level do site owners, members and visitors have?

Owners have Full Control, Members have Edit and Visitors have Read, by default.

What is the difference between Edit and Contribute?

Edit can add, edit and delete lists as well as list items and documents. Contribute can view, add, update and delete list items and documents but cannot manage lists.

What is Limited Access in SharePoint?

SharePoint assigns it automatically when you give someone access to one item, so they can browse to it. It grants no other permissions, and you cannot assign it directly.

What is the difference between Read and View Only?

Read can view pages and items and download documents. View Only can view them, but documents that have a server-side file handler open in the browser and cannot be downloaded.

Can I change the default permission levels?

You can change all of them except Full Control and Limited Access.

Does a file inherit permissions from its library?

Yes, by default. Someone with control of the library can stop inheritance for a specific file, and sharing a file with someone who lacks access stops inheritance on that file automatically.

Related reading

• SharePoint RBAC explained - roles, groups and setup.
• SharePoint document library security - permissions inside libraries.
• Request access to a SharePoint site - who approves and where.
• How to create a SharePoint site - team or communication site.
• SharePoint hub sites - association does not change permissions.