How to Restrict a Confidential SharePoint Folder to the Right Group

Pick the route before you touch a setting

Start with what you are protecting, because the right control depends on how much of it there is. A folder called Private is a request, not a control. Something has to enforce it, and SharePoint offers several ways with very different upkeep.

Microsoft's guidance leans towards simplicity. For team sites it says permissions are best managed through the connected Microsoft 365 group, and it recommends against managing site permissions separately from that group where you can avoid it. The UK NCSC's cloud guidance says much the same in general terms: apply permissions to named groups rather than individuals, and remove unused permissions over time. That gives a clear order of preference.

Throughout this article we use an invented example: a 25-person firm, Fenwick and Marsh Ltd, with a Salary Reviews folder that only the people in its HR Confidential group should be able to open.

• A whole body of confidential material (payroll, HR cases, board papers): give it its own private site. Membership of one group is the access list, so there are no inherited permissions to forget.
• One folder with a handful of files in an otherwise ordinary site: give that folder its own permissions. It works, but you are creating an exception that someone must remember.
• Several folders, each with a different audience: that is the signal to split them into separate sites. Microsoft documents a supported limit of 50,000 uniquely permissioned items per library and recommends staying around 5,000, so a maze of exceptions is both hard to audit and a scaling problem.

Before you begin

You need a few things in place first. None of them are exotic, but missing the test account is the most common way to end up believing something is locked down when it is not.

• The right access: site owner (or site admin) on the site for folder changes, SharePoint Administrator for anything in the SharePoint admin center, and someone allowed to create and manage groups in Microsoft 365 or Microsoft Entra.
• A security group or Microsoft 365 group containing exactly the people who should see the material. Distribution lists that are not security groups cannot be granted permissions, and Microsoft advises against nesting security groups inside SharePoint groups because of performance problems.
• One ordinary test account that is not in the group. Site admins can reach every item in a site even when inheritance has been broken, so an administrator account will tell you nothing useful.
• A note of who can open the material today. You will want it for comparison if you need to roll back.

Route one: give the material its own private site

A separate site is the cleanest answer because everything about it, from membership to sharing settings, can be set for that one purpose. Creating a team site also creates a connected Microsoft 365 group, and group owners become site owners while group members become site members.

Copying a large amount of content between sites can take a while. Microsoft documents limits of 100 GB total and 30,000 files for a single cross-site move or copy, so split big sets into batches and carry on once the files appear in the new library.

1. Create a new team site from SharePoint. Give it a name that says what it holds, such as HR Confidential, and set its privacy to Private. A Public group site can be reached by anyone in your organisation.
2. Add the people who should have access as members of the site's Microsoft 365 group, and keep at least two owners so the site is never orphaned. Manage this through the group rather than adding people directly to the site's SharePoint groups, which splits your access list in two places.
3. If some people only need to read the material, add them directly to the site's Visitors group. Microsoft 365 groups have no view-only role, so Visitors is the supported way to give read-only access.
4. Copy the confidential files into the new site. Leave the originals where they are for now.
5. Work through the checks in the section further down. Only when the new site passes should you delete the originals, because until then the old copy is still as open as it ever was. Deleted files normally remain recoverable from the recycle bin for a period, so empty it too if removal is the point.

Route two: restrict one folder with its own permissions

By default a folder inherits its permissions from the library, which inherits from the site. Stopping inheritance gives the folder its own access list. The folder starts as a copy of what it had, so nothing changes until you remove people from it.

Microsoft supports this but recommends the built-in SharePoint groups or the Microsoft 365 group instead, and each exception is a unique permission that counts towards the library limits. If a library or folder holds more than 100,000 items you cannot stop or restore inheritance on it at all.

This is a change to who can see real files, so do it when you can immediately test the result. Removing groups from the folder will lock out anyone who is not in your replacement group, and that is the intention.

1. Open the folder's permissions page. In the modern interface this is normally reached from the folder's Manage access panel and its Advanced link. Labels differ a little between interface versions, and the page you want is the one listing the folder's permission groups with a Stop Inheriting Permissions button in its ribbon.
2. Select Stop Inheriting Permissions and confirm the warning. From now on, changes made at the library or site level no longer flow down to this folder.
3. Remove the groups that should not have access, which usually means the site Members and Visitors groups and the connected Microsoft 365 group. Leave the site Owners group so the folder can still be managed. Do this on the folder itself, not on the parent library. Removing a group from a parent also removes it from every child item, including those with unique permissions, and Microsoft warns this cannot be undone.
4. Select Grant Permissions, enter the name of your security group and choose the permission level. The default is Edit. Select Show options if the group should only have Read. Selecting Show options also lets you turn off the email invitation.
5. Confirm that the permissions page now says the folder has unique permissions and lists only the owners group and your security group.
6. To roll back, select Delete unique permissions on the same page. This restores inheritance, so the folder becomes visible again to everyone who can see the parent library, and it removes the custom permissions you set.

Close the side doors

Permissions are only one route to a file. Sharing links are a separate route, and Microsoft's own admin documentation says people may have access to files and folders through sharing links as well as through the site's roles. A restricted folder that someone can still share with a link is not really restricted.

• Sharing a single item breaks inheritance for that item automatically, so a well-meaning member sharing one file from your confidential folder creates another exception outside your plan. Limit who can share: the SharePoint admin center setting under Site permissions, Site Sharing, Change how members can share lets you choose that only site owners can share files, folders and the site.
• Know your link types. Anyone links need no sign-in and cannot be audited, People in your organization links work for everyone inside the tenant and Specific people links only work for the named people.
• Microsoft recommends that confidential information that should never be shared externally lives in a site with external sharing turned off. For Route one, set that on the new site. For Route two, remember that site-level external sharing applies to the whole site, not the folder.
• Site owners and site admins can always get to the material. Keep those groups small, and treat each owner as someone with access to the confidential folder.

Check it worked

Do these checks with a real user account rather than reading the permissions page and hoping. They take a few minutes and are the only way to know the control behaves as intended.

1. Sign in as an ordinary member of the group in a private browser window. Open the folder and a file inside it. This should work without requesting access.
2. Sign in as your non-member test account in another private window. Try the folder's direct address and then the site. This should be refused or lead to an access request, not to the files.
3. Search for a distinctive file name as the non-member. Search results can lag behind permission changes, so repeat the check later if you have just made the change.
4. Open the folder's sharing and access details and look for sharing links or named individuals that you did not expect. Remove anything that should not be there.
5. Write down the group name and the date, and put a recurring reminder in the calendar to confirm the membership is still right. NCSC guidance asks for periodic checks that access still meets your needs, and group membership is the part that drifts.

An optional extra guard: restricted access control and labels

Restricted access control is a SharePoint policy that makes a site check group membership as well as permission. Users who are not in the nominated group cannot open the site or its content, even if they previously had a sharing link, and organisation-wide search and Copilot honour the policy. It works on the whole site, so it suits Route one and does nothing for a single folder.

The licensing catch matters, particularly for small businesses. Microsoft lists Office 365 E3, E5 or A5 and Microsoft 365 E1, E3, E5 or A5 (plus government clouds) as the required base subscriptions, together with either at least one assigned Microsoft Copilot licence or the SharePoint Advanced Management Plan 1 add-on. Microsoft 365 Business plans are not on that list, so confirm eligibility before building a plan around it.

Adding people to the control group does not give them access. A person needs both permission to the site and membership of the group. On a group-connected site the connected Microsoft 365 group is the default control group, so everyone already in that group stays in. Private channel and shared channel sites are separate sites and need the policy set separately.

A sensitivity label on the site is the other site-level option. A container label can lock privacy to Private and control external sharing, among other settings. Items inside the site do not inherit the label, so file protection such as encryption is a separate job, and the licensing for labels should be checked against Microsoft's Purview service description.

Switching on the tenant setting can take up to an hour to take effect. Once a site is protected, users outside the group are blocked, so confirm the group is complete first.

1. Confirm your tenant meets the licensing described above and that you hold the SharePoint Administrator role, or the SharePoint Advanced Management Administrator role.
2. Install the current SharePoint Online Management Shell and connect to the admin site. Replace YOURTENANT with your tenant name. You will be asked to sign in.
   powershellCopy

   Connect-SPOService -Url https://YOURTENANT-admin.sharepoint.com

3. Allow restricted access control for the organisation. In the SharePoint admin center this is Policies, Access control, Site-level access restriction, then Allow access restriction and Save. Alternatively run the command below, which changes a tenant-wide setting but does not protect any site by itself. It can take up to an hour to take effect.
   powershellCopy

   Set-SPOTenant -EnableRestrictedAccessControl $true

4. Find the object ID of your security group in the Microsoft Entra admin center, on the group's overview page.
5. Turn the policy on for the site and add the group. Replace YOUR_SITE_URL with the full site address and YOUR_GROUP_OBJECT_ID with the ID from the last step. The site is not restricted until at least one group has been added.
   powershellCopy

   Set-SPOSite -Identity YOUR_SITE_URL -RestrictedAccessControl $true
   Set-SPOSite -Identity YOUR_SITE_URL -AddRestrictedAccessControlGroups YOUR_GROUP_OBJECT_ID

6. Read the setting back to confirm it. This command only reads.
   powershellCopy

   Get-SPOSite -Identity YOUR_SITE_URL | Select RestrictedAccessControl, RestrictedAccessControlGroups

7. Test again with your group member and non-member accounts. Search and Copilot can take longer to reflect the policy on larger sites.
8. To roll back, clear the policy for the site. Access then returns to whatever the site's ordinary permissions allow.
   powershellCopy

   Set-SPOSite -Identity YOUR_SITE_URL -ClearRestrictedAccessControl

If it did not work

Most failures come from one of a few causes. Work from the simplest.

• A group member cannot open the folder: confirm they are in the security group itself rather than a distribution list, then have them sign out and back in. Membership changes can take a little time to apply.
• A non-member can still open it: look for a sharing link, an Anyone link, direct permissions on a file inside the folder or ownership of the site. Remember that site admins always see everything.
• You get a message that you cannot share or break inheritance because there are too many items in the folder or library: you have hit the 100,000-item limit or the unique permissions limit. Reduce the number of items, or the number of uniquely permissioned items, and try again, or move to Route one.
• Grant Permissions is missing: it only appears after inheritance has been stopped.
• A private or shared Teams channel: its SharePoint site is managed from Teams. SharePoint shows its permissions read-only.
• Restricted access control is blocking a legitimate user: they need both site permission and group membership, so check both before anything else.