We're in financial services and using the NIST CSF 2.0 outcomes-based framework. As we move more workloads into SharePoint, I'm trying to establish a permissions and governance model that will hold up during audits.
Do you allow business owners to manage sites and share content directly? Or do you restrict access to Entra security groups and Microsoft 365 groups associated with each site? A possible middle ground would be letting business owners manage membership in approved groups while keeping SharePoint permissions group-based and auditable.
I'm also interested in how others use SharePoint governance reports to identify which sites and files a user can access. What process do you use to review access regularly without turning it into a huge administrative burden?
3 Answers
Keep the model as simple as possible: avoid unique permissions and subsites, and grant access through groups rather than individual users. Assign a business owner to each site and make that person accountable for reviewing membership, even if the review itself is delegated.
It also helps to document role-based access and define what happens when someone changes jobs. IT should maintain the platform and automate the review process, but the business should decide who actually needs access. A quarterly report or workflow showing group members and asking the business owner to confirm them gives you a clear audit trail.
For recurring reviews, combine Entra access reviews with a readable export of site and group membership. A weekly or monthly difference report can show additions and removals, while quarterly owner sign-off provides the formal evidence for an audit.
SharePoint governance and access reports can help identify sharing links, broad access, sensitivity-label issues, and sites with risky configurations. They are useful for finding problems, but they may not provide one complete “everything this user can access” view. A group-only permission model is still the best way to make that question manageable, especially because overshared content can also become discoverable through Microsoft 365 features such as Copilot.
A practical approach is to use Microsoft 365 or Entra security groups for all site access, with business owners managing membership rather than SharePoint permissions. That gives you a straightforward answer when auditors ask what a user can access: review the user’s group memberships.
The important part is preventing exceptions. Restrict direct sharing, disable anonymous links, use “People with existing access” as the default link type, and prevent broad claims such as “Everyone except external users” from being selected accidentally. Also prohibit item-level permission breaks unless there is a documented exception.
The middle-ground model works well, but make sure group membership changes are attributable. If business owners add users directly, your reports should retain enough history to show who made the change and when.