SharePoint permission levels are named bundles of rights. Read views, Contribute edits items, Edit also manages lists, Design builds pages and Full Control does everything. Members get Edit by default, which is often too much. Give groups the lowest level that works.
Someone asks for access to a SharePoint site. You open the permissions page and see words like Contribute, Edit, Design and Full Control. Which one is right? Choose wrong and a new hire deletes a list, or a manager cannot upload a file.
I get this question every week. This guide explains SharePoint permission levels in plain words, shows what Contribute and Edit really change, sorts out Members and Site members, and ends with the steps to check levels on your own site.
What are SharePoint Permission Levels?
A permission level is a named bundle of rights. Instead of ticking thirty boxes for every person, SharePoint gives you a short list of ready bundles, and you give a bundle to a group. SharePoint permission levels answer one question: what can this person do on this site, library or item?
Microsoft's page on permission levels lists the default set. It also says an admin can define custom levels, and that you can change any default level except Full Control and Limited Access.
Which SharePoint Permission Levels Come by Default?
There are ten on the Microsoft list, but five do almost all the work. Read, Contribute, Edit, Design and Full Control are the ones you will assign. The rest are special cases.
| Level | What it allows | Default group |
|---|---|---|
| Full Control | All available SharePoint permissions. You cannot customize or delete it | Owners |
| Design | Create lists and libraries, edit pages and apply themes and style sheets | None |
| Edit | Add, edit and delete lists. View, add, update and delete list items and documents | Members |
| Contribute | View, add, update and delete list items and documents | None |
| Read | View pages and items and download documents | Visitors |
| Limited Access | Lets a person reach one shared item without seeing anything else | Set by SharePoint |
| View Only | View pages and items. Files with a server-side handler open in the browser but cannot be downloaded | None |
Approve, Manage Hierarchy, Restricted Read and Web-Only Limited Access complete the list. They show up in publishing sites and special setups, so most teams never touch them.
Most permission mistakes are not hacks. They are a kind admin who gave Edit because it felt safer than saying no. Start low and raise the level when someone asks.
Jamie Kaler Marketing Head and Content Strategist, RecoveryTools
What is the Difference Between Contribute and Edit?
Lists. Both levels can view, add, update and delete list items and documents. Only Edit can also add, edit and delete the lists themselves. That is the line between working inside a container and being able to remove the container.
This matters because the Members group gets Edit by default. A new team member can then delete an entire library, which is rarely the plan. If your members only need to add and change files, a custom level based on Contribute is the safer fit.
| Action | Contribute | Edit |
|---|---|---|
| View, add, update and delete items | Yes | Yes |
| View, add, update and delete documents | Yes | Yes |
| Add a list or library | No | Yes |
| Edit or delete a list or library | No | Yes |
What are Members and Site Members in SharePoint?
The names confuse people because two group systems sit side by side. A SharePoint group has Owners, Members and Visitors, and it works only inside SharePoint. A Microsoft 365 group has Owners and Members, and it works across SharePoint, Teams, Outlook and more.
In the site sharing panel, SharePoint shows its three groups as Site owners, Site members and Site visitors. By default Owners get Full Control, Members get Edit and Visitors get Read.
A Microsoft Q&A answer adds a warning. Its author says that adding a person to the Microsoft 365 group does not give access to the site by itself, and that the fix was to add the Microsoft 365 group to the Site members group. This is a community answer and not official documentation, so test it on your own site before you rely on it.
What does Limited Access Mean?
It is the level you never assign yourself. SharePoint adds it when you share one file or folder with someone who has no other access. It lets the person browse to that item and nothing else, and it grants no extra rights.
You will see Limited Access in the permissions page next to people you never added. That is normal. It becomes a problem only when a site has hundreds of shared items, because every share can add another entry.
How does Permission Inheritance Work?
Sites, libraries and items inherit from their parent by design. A library inherits from its site. A file inherits from its library. If you give an item unique permissions, it stops inheriting, and later changes at the site level no longer reach it.
Microsoft notes that sharing a document with someone who has no access stops inheritance on that document automatically. Over time this creates a patchwork of broken inheritance. It is the first thing I check when a client says nobody knows who can see what.
How do You Check SharePoint Permission Levels on a Site?
Follow this order on any site you own. You need Full Control to see every page.
- Open the site settings. Select the gear icon, then Site permissions.
- Open the advanced page. Select Advanced permissions settings to see the classic permissions page.
- Read the groups and their levels. Note which groups exist and which level sits next to every one.
- Open Permission Levels. Select Permission Levels in the ribbon to see every level defined on the site.
- Select a level name. Read the exact rights it holds. Full Control and Limited Access cannot be changed.
- Copy a level to build a custom one. Use the copy option on the level page, give it a clear name and clear the rights you want to remove, like Delete Items.
- Assign levels to groups. Give the new level to a group and add people to the group, so you never grant rights to single users.
- Test with a real account. Sign in as a test user in a private window and try to add, edit and delete a file.
Menu names change as Microsoft updates the interface, so treat the wording above as a guide and look for the same idea. Step 8 is the one people skip, and it is the only step that proves the change worked.
When should You Create a Custom Permission Level?
When a default level gives too much or too little. Two cases come up again and again. The first is Contribute without delete, for teams that drop invoices or contracts into a library and should not remove them. The second is a view-only level for sensitive files that people may open in the browser but not download.
Copy the closest default level, remove only what you must and give the new level a name people understand. Microsoft also tells you that only the Open permission has no dependencies, so clearing it clears all the others. That is a quick way to test a custom level.
Do SharePoint Permission Levels Survive a Migration?
The levels and groups can move, but the people have to exist in the target first. A group that points at users who are missing in the new tenant arrives empty, and every item with unique permissions needs a second look.
I cover the full order of work in how to migrate SharePoint permissions to another tenant. Links people saved before the move are a separate problem, described in what happens to SharePoint sharing links after migration. For the wider plan, see how to migrate a SharePoint site to another tenant.
Move Sites With Their Permissions in Place
RecoveryTools SharePoint Migrator moves sites, libraries and lists between two Microsoft 365 accounts with permissions, versions and metadata. Create and map the target users first, and test one site before you start the full batch.
No credit card, no sign-up. Works on Windows 11, 10 and Windows Server.
Which Permission Level Mistakes Cause the Most Trouble?
Four show up in almost every audit I do. First, leaving Members on Edit when Contribute is enough. Second, giving rights to single people instead of groups. Third, breaking inheritance on a folder and forgetting it. Fourth, adding people to Owners because it was faster than finding the right level.
My Verdict on SharePoint Permission Levels
Use groups, not people. Start with Read and raise the level only when someone cannot finish a task. Check Members, because Edit is a bigger gift than most owners expect.
Review the permissions page every quarter. Ten minutes there prevents the call that begins with "why can everybody see this?".
Frequently Asked Questions
What are the Default SharePoint Permission Levels?
Full Control, Design, Edit, Contribute, Read, Limited Access, Web-Only Limited Access, Approve, Manage Hierarchy, Restricted Read and View Only. Most sites use Full Control, Edit and Read through the Owners, Members and Visitors groups.
What is the Difference Between Contribute and Edit in SharePoint?
Both can view, add, update and delete items and documents. Only Edit can also add, edit and delete lists and libraries. That is why Edit is the riskier level to give to every member.
What is the Difference Between Members and Site Members?
Site members is the label for the SharePoint Members group in the sharing panel, and by default it holds Edit. A Microsoft 365 group also has members, but a Microsoft Q&A answer says those people do not reach the site until the group is added to Site members.
Can I Edit the Full Control Level?
No. Microsoft says you can change any default level except Full Control and Limited Access. Create a custom level instead.
What does Limited Access Mean in SharePoint?
SharePoint adds it when you share one item with a person who has no other access. It lets them reach that item and grants no additional rights.
Do SharePoint Permission Levels Migrate to Another Tenant?
They can, but the users and groups must exist in the target first. Map the people before you move the content, then check items with unique permissions after the move.
Jamie blends strategic marketing insight with technical writing, turning migration and recovery topics into guidance that works for technical and general readers alike.
Published 15 October 2026. Level names, rights and defaults come from Microsoft's page on understanding permission levels. The Members and Site members point comes from a Microsoft Q&A answer, which is community guidance and not official documentation.