Fix SharePoint Subfolder Users Still Have Edit Access After Removal
Question details
The user needs to revoke edit access from former users on a SharePoint document library subfolder that currently retains unauthorized access despite having unique permissions configured.
- Product
- Microsoft SharePoint
- Device & OS
- not provided
- Scenario
- Managing unique permissions for a SharePoint subfolder to restrict user access.
- Observed behavior
- Former users can still access and edit the subfolder even after being explicitly removed from the access list, and permission checks confirm they still have access.
Verify that you have Site Administrator or Full Control privileges in the SharePoint site, as modifying advanced permission settings and reviewing access logs requires sufficient rights.
Check and Remove Active Sharing Links
Sharing links can bypass direct folder permissions and grant access to anyone holding the link, even if they were removed from the direct access list.
SharePoint allows files and folders to be shared via direct links. If a former user was given an 'Anyone with the link' or 'People in your organization' edit link, they will retain access until the link is deleted.
Navigate to your SharePoint document library and locate the specific subfolder that the users are still accessing.
Click the vertical ellipsis (three dots) next to the folder name and select 'Manage access' from the dropdown menu.
In the Manage Access panel, navigate to the 'Links' tab to review all active sharing links associated with this folder.
Click the trash can icon next to any sharing links that grant edit access to ensure former users can no longer use them to bypass unique permissions.
Verify Group Memberships and Advanced Permission Settings
Ensure that the folder is truly not inheriting permissions and that the former users are not gaining access through another Microsoft 365 or SharePoint group.
Escalate to Microsoft 365 Support
If unique permissions are correctly set and no sharing links or groups exist, the issue may be caused by a backend tenant synchronization failure that requires Microsoft's intervention.
Switch to WPS Office for Secure and Seamless Document Management
While resolving complex enterprise server permission issues in SharePoint often requires backend administrator support, managing your everyday office documents shouldn't be a hassle. WPS Office provides a lightweight, highly compatible alternative for creating, editing, and locally managing your files safely.
- 1. Download the Installer: Visit the official WPS Office website and download the free version for your operating system.
- 2. Install WPS Office: Run the setup file and follow the quick installation prompts to set up the software.
- 3. Start Editing Securely: Open WPS Office to seamlessly view, edit, and encrypt your office files without relying on complex cloud server permissions.
Frequently Asked Questions
Why does a user still have access after I remove them from a SharePoint folder?
A user might still retain access if they have an active sharing link, are a member of a higher-level SharePoint or Microsoft 365 group that has access, or if the folder is still inheriting permissions from the parent site.
How do I check if a SharePoint folder has unique permissions?
Navigate to the folder, click 'Manage access', select 'Advanced', and look at the top ribbon. If you see the option 'Delete unique permissions', the folder is using unique permissions. If it says 'Stop Inheriting Permissions', it is still inheriting from its parent.
What should I do if the Check Permissions tool shows a user has access but they aren't listed directly?
The Check Permissions tool will usually display the exact route of access (e.g., via 'Team Site Members' group). You must check the memberships of the mentioned group and remove the user from it to revoke access.
Can cached credentials cause a removed user to still edit a folder?
Yes, sometimes a local browser cache or Office application token delay can allow temporary access to a document. Asking the removed user to sign out, clear their cache, and sign back in, or simply waiting for backend server synchronization, can sometimes resolve phantom access issues.
