How to Create SharePoint Folders with Unique Permissions for Guests
Question details
The user needs to configure separate SharePoint folders or document libraries with unique, restricted permissions for external guests to limit access and prevent file downloads.
- Product
- Microsoft SharePoint
- Device & OS
- not provided
- Scenario
- Securely sharing specific documents with external users while maintaining strict control over who can view or download the files.
- Observed behavior
- Requires establishing custom read-only or restricted-view access specifically tailored for guest accounts without giving them default site-wide access.
Ensure you have Full Control or Site Owner permissions for the SharePoint site before attempting to modify document library or folder access rights.
Manually Configure Unique Folder Permissions
Creating a dedicated folder and manually breaking permission inheritance is the most reliable way to enforce restricted guest access and block downloads.
SharePoint Online does not provide an out-of-the-box way to automatically isolate invited guests into separate custom SharePoint groups. For granular control, access must be managed manually at the folder or library level by breaking inheritance and applying specific view-only roles.
Navigate to your SharePoint site, click on 'New', and select 'Folder' or 'Document library' to create a dedicated space for guest files.
Hover over the new folder, click the three-dot menu (Show actions), and select 'Manage Access'. Click 'Advanced settings' at the bottom, then click 'Stop Inheriting Permissions' in the ribbon menu.
Click 'Grant Permissions' in the ribbon. Enter the email addresses of your external guests. Before sharing, click 'Show options' and change the permission level to 'Restricted View' or 'Read'.
Sign in with a test external guest account to verify that the 'Restricted View' permission successfully allows online file viewing while blocking the ability to download, print, or sync the documents.
Automate Guest Access via Microsoft Entra ID Dynamic Groups
Use dynamic security groups in Microsoft Entra ID to automatically group guests based on specific attributes, simplifying bulk permission assignments in SharePoint.
Discover WPS Office for Seamless Collaboration
While SharePoint manages complex enterprise permissions, WPS Office provides a lightweight, user-friendly alternative for everyday document creation and sharing. With its built-in cloud capabilities, collaborating with external guests on documents is incredibly straightforward.
- 1. Download and Install WPS Office: Visit the official WPS website to download the free suite and install it on your device.
- 2. Sign In to WPS Cloud: Create a free account or sign in to access WPS Cloud storage and collaboration features.
- 3. Share with Guests: Right-click any folder or document in your WPS Cloud, select 'Share', and customize the viewing or editing permissions for your external guests.
Frequently Asked Questions
Can I prevent guests from downloading files in SharePoint?
Yes. By navigating to the advanced permissions of a file or folder, you can assign the 'Restricted View' permission level to the guest user. This allows them to view the document in their web browser but removes the download, print, and sync buttons.
Why are external guests automatically getting access to my entire SharePoint site?
If guests are added to the default 'Site Members' or 'Site Visitors' groups during the sharing process, they inherit permissions for the entire site. To prevent this, always share specific folders directly and avoid adding guests to site-wide default groups.
Do I need a premium license to manage SharePoint guest groups?
Standard manual grouping and permission sharing in SharePoint do not require additional premium licenses. However, if you want to use Microsoft Entra ID to create dynamic rules that automatically group users based on attributes, a Microsoft Entra ID P1 or P2 license is required.
