Permissions
2000 TopicsUPDATE: Create Office 365 Groups with team sites from SharePoint home moving beyond First Release
We recently completed the worldwide rollout for Office 365 Groups getting full-powered SharePoint team sites at the end of January 2017. Our next step is to now bring the ability to create SharePoint team sites connected to Office 365 Groups from SharePoint home beyond First Release. This next phase of rollout will begin today, and is expected to reach all customers worldwide over the next month. We also wanted to share some of the additional capabilities we’ve added to group-connected team sites since we first began roll out to First Release. No matter where you create an Office 365 Group from – whether SharePoint, Outlook, Microsoft Teams, Yammer, or elsewhere – you consistently get the full collaborative power of a connected SharePoint Online team site among the other services groups provides (shared inbox, shared calendar, Planner plan, team notebook, and more). This move beyond First Release includes the capabilities described in our November blog post: Fast creation of sites connected to Office 365 Groups from the SharePoint home page Editable team site home pages that look great at your desk and on your phone Modern creation panels for new libraries and lists In-place navigation editing Site settings panels for editing site information and site permissions Modern page creation in classic sites Admin controls for team site creation The site permissions panel listed above has been enhanced to include options for adding members to the site’s Office 365 Group or simply sharing only the team site without providing access to other group resources. The panel is intended to provide simple permissions management, but also includes a link to ‘Advanced permission settings’ for site owners that have a need to do things like add custom SharePoint permissions & mappings. Note this panel also allows you to add users or groups to the ‘Site Visitors’ permissions group, so it is easy to provide read-only access to the site. All you need to do is add a new person or group via the ‘Invite people’ button, and then change their permission level to ‘Read’. The user or group’s permission level determines which permission group they appear under – those with ‘Read’ permission will appear in the ‘Site Visitors’ category. Managing group-connected team sites Since new team sites are connected to Office 365 Groups, managing them involves possible interactions with Office 365 Group settings in addition to those provided by SharePoint. Examples include settings that apply to groups such as whether group creation is allowed in the tenant, which users are permitted to create groups, usage guidelines URL or group classification labels. Once the group-connected site is created, management of the site is likewise split between Azure Active Directory (AAD) PowerShell cmdlets and the SharePoint Online Management Shell. Anything dealing with creation, deletion, un-delete (restore) or membership happens through AAD. SharePoint-specific management, such as storage quota and link sharing policies, take place using the SharePoint management tools. For governing modern site creation, this support page details the administrative controls, but is useful to summarize the relationship between a group’s policy settings and how the SharePoint ‘Create site’ experience behaves. By default, if group creation is enabled in the tenant, the ‘Create site’ command will appear on SharePoint home, and if a user is permitted to create groups they will get the site creation experience. If the user is *not* permitted to create groups, they will get the classic self service provisioning experience that results in the creation of a subsite. The table below describes how the combination of group and site creation settings work together: * The current user is considered to have group creation permissions if the AAD property EnableGroupCreation is true, or it is false but the user is a member of the security group assigned to the GroupCreationAllowedId AAD property. ** Site creation is enabled via SharePoint Admin Center under Site creation settings: In addition to managing site creation, we are also enabling the SharePoint Online PowerShell cmdlets to administer modern, group-connected site collections. This means that modern team site collections can now be enumerated with the Get-SPOSite cmdlet with the following example: Get-SPOSite -Template GROUP#0 -IncludePersonalSite:$false Most parameters for these site collections can also be set using the Set-SPOSite cmdlet, with the exception of those that would result in breaking connection with their corresponding Office 365 Group (e.g. you cannot set the Owner property using this cmdlet – you would need to set the Group’s owners via AAD). Please refer to the respective documentation for each of the above cmdlets for additional details. For more information on using PowerShell to manage Office 365 Groups, this article may be helpful as well. What else is new? In addition to the above, this phase of the rollout includes a couple of previously unannounced capabilities. The first is a group membership management experience that lives in SharePoint itself. Now, when you click on the member count of the group in the site header, you will be presented with a new group membership panel that allows you to add members and change their roles between owners and members, or remove them outright. Users will no longer need to jump to Outlook to manage the group’s membership. The second is Content Type Hub syndication – modern sites can now consume content types that have been published from a central content type hub. We heard feedback that this is an important feature to enable, and we are including it in this rollout. As noted above, this rollout will take place over the course of a few weeks. We are very excited for you to take advantage of modern, connected team sites and look forward to any feedback or questions you may have. As always, please ask in a reply to this thread. Thanks, Tejas89KViews29likes76CommentsSite Collection Admin for over quota ODfB
As a Global Admin I went to help a user with an A1 license where the ODfB had been set with a quota of 100GB (Microsoft's new A1 storage quotas - ref https://techcommunity.microsoft.com/t5/education-blog/program-updates-in-microsoft-365-for-education/ba-p/3885932). Because the ODfB was "over quota", I was unable to add a new Site Collection Admin. So I can't see what is using up the space and therefore am unable to assist the user. I tried adding the global admin acount via the SharePoint User Profile element in SharePoint admin centre but this failed with a "No Space" message. Given that we soon won't be able to extend an A1 licensed user's quota beyond the 100GB enforced MS quota, how are we supposed to assist users if we cannot add a global admin / sharepoint admin account to the collection admins to assist the user in getting their usage under quota? SharePoint admins / Global Admins should still be able to add themselves to view a OneDrive to assist a user in getting their usage under control.410Views9likes0CommentsThe Future of SharePoint - 7 videos - Demos and tours from the May 2016 announcement
Foundation for the Future: SharePoint Server 2016 Your Intranet in Your Pocket: The SharePoint mobile app The Mobile and Intelligent Intranet: SharePoint sites and PowerApps Effortless File Sharing on Any Device: OneDrive for Business and SharePoint Security, Privacy and Compliance for SharePoint and OneDrive for Business Accelerating Innovation with Hybrid: SharePoint Server 2016 and Office 365 Open and Connected Platform: The SharePoint Framework1.7KViews9likes2CommentsSharePoint Security and Compliance Updates [VIDEO]
Principal engineer and SharePoint security expert, Navjot Virk to demonstrate security and compliance updates in SharePoint. Conditional access controls to safeguard against insecure networks and devices. Data governance capabilities for site classification. Unified auditing within hybrid environments.3.5KViews5likes4CommentsO365 Global Admin has no access to recent SharePoint Online site collections
Is it just me, or has anyone else noticed that O365 Global Admins do not automatically get access to recently created Site Collections in SharePoint Online? We have a small group of O365 Global Admins and all of us have MFA enabled. This means that we often can't use our accounts for scripting and other various O365 add-ins/tools. So I have a service account setup, which is also a Global Admin, but doesn't have MFA. This account is able to get to older Site Collections (where it's not specifically in the SP Groups), but it's unable to access more recently created site collections. I either get the: Access Denied myserviceaccount@corp.onmicrosoft.com does not have permissions to access this resource. Here are a few ideas: Please ask the site admin to give you access. If you have a different account, try signing in with that account. This will sign you out of all other Office 365 services that you're signed into at this time. If this problem persists, contact your support team and include these technical details: Correlation ID: xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx Date and Time: 15/11/2016 2:00:00 p.m. User: myserviceaccount@corp.onmicrosoft.com Issue Type: User does not have permissions. Or I get the: You need permission to access this site. [I'd like access, please.] Request Access Judging by the sites that work, this change looks to have been in about the last month or so. Anyone else seeing this? I'm going to try creating a SPAdmin only account and see if that has better luck than a Global admin. Thanks CraigSolved69KViews5likes30CommentsSharePoint permission group expiration
Please consider creating an expiration property for SharePoint permission groups. This would be especially handy in the university setting for SharePoint groups which are created for research projects and classes. Since SharePoint groups can be created by mortals (site owners), this setting could be added/edited without intervention from O365 admins. Thank you! --Susan Pierce University of Texas Arlington665Views5likes0CommentsRestore default SharePoint groups (Owners, Members, Visitors)
Hello All, I just learned how to restore the deleted default SharePoint access groups: Owners, Members, Visitors. For those still looking for a way to do this: just open <siteurl>/_layouts/15/permsetup.aspx, and you will be offered to create them or select existing ones. Click OK and you are done. The part I am stuck is, how to assign these groups to the items with broken inheritance? I have already pulled a report and identified 39 items (files and folders) with custom permissions, do I just go to each and assign the 3 groups, or is there a better way to do it? I appreciate your help in this. Regards, Adrian57KViews5likes4CommentsCustomize Default Sharing options per Site Collection
Noticed this sitting in Admin messages just now. Have one reaction to it :). New feature: Customized Sharing Defaults per SharePoint Site Collection MC138254 Stay Informed Published On : May 16, 2018 In SharePoint Online, Default sharing link types and Default sharing link permissions are now available to be customized per site collection. We’ve begun rolling this out now, and it will be available worldwide by the end of June. While our goal is to ensure we notify you in advance of upcoming changes, we acknowledge we did not provide timely notice for this change. We will continue to look for ways to improve our notifications. This message is associated with Office 365 Roadmap ID 30568. How does this affect me? You can now configure the default link type and default link permission for your users in SharePoint Online and OneDrive for Business. With this change, you may now further customize the default sharing settings on a per site collection basis. These settings may be set via the classic SharePoint admin center or viaSharePoint Online Management Shell. What do I need to do to prepare for this change? There is nothing you need to do to prepare for this change. Please click Additional Information to learn more. Additional information5.3KViews5likes12CommentsIs Contribute permissions required to start a workflow?
I have tested and confirmed on multiple SharePoint 2016 environments, all with Workflow Manager 1.0, the following issues for users who do not have contribute permissions to the parent web/site: Users cannot see workflow subscriptions on a document/item Users cannot initiate a workflow set to start automatically, that is, a workflow set to start on item creation will not start if the uploading user does not have contribute rights to the parent web It does not seem to matter if the user has contribute rights to the list/library itself, they must have those permissions at the web level. If I increase the user permissions to contribute at the parent web, workflows are now enumerated for the user - and they are able to initiate a workflow set to start automatically. Note that this behavior only affects the 2013 Workflow (WFM 1.0) platform, not 2010-based workflows. Is this behavior by design/to be expected, or is this a bug? I have included some screenshots to help illustrate the issue: Before granting Contribute rights - no workflows visible, nothing to start After granting Contribute rights, same item - can now start workflow and see the previous (errored) workflow Uploading a new item after given Contribute rights - WF starts automatically and completes21KViews4likes4CommentsHow to handle very Large document (1000 of pages) in SharePoint
SharePoint Solution for very large documents I know its a simple solution and I have presented to some of my customer, Just wanted to get your opinion that is there a better way to handle these large document with SharePoint? Please feel free to comment on it , I would like to see if there are better option leveraging any other apps with in MS 365 A slide from my Solution presentation. When you have a large set of documents which are hundreds of thousands of pages, such as Product Manuals, corporate policies, Keying instructions files etc,... Here are some customer use cases/ pain points with respect to handling large documents within their corporate content management space. A single document which has several pages (1000+ pages) Document that are edited or updated on a regular basis. Versioning of the document continues to exist for audit and as a reference Only particular pages of the document to be shared with particular users and not the whole document External sharing & editing Editing and referencing other child document references within a document In such cases it is not advisable or even feasible to keep these large files in One Drive or SharePoint library. Splitting the files into smaller chunks and uploading is not an option either. One solution that I implemented for one of our clients is to transform these large documents into SharePoint Wiki pages and load them into Wiki libraries. SharePoint Wiki pages are widely used in organizations and easy to create,edit, share information and collaborate with others. They are very intuitive to create and use and thus easy for the users to adopt and maintain. Solution diagram Benefits of migrating to wiki pages: Ability to edit and publish individual pages and not the whole document (that has 1000+ pages) every time a page is edited. Minor versions and comments : Versions are created only for the edited pages and tracking the version is easy and color coded. Table of contents & easy navigation to the pages: Relevant pages are grouped together through table of contents and quick link references to other related materials can be maintained Embedding diagrams, reports, tables, lists, pictures and videos is easy. These can be simply loaded from the managed library. Ability to save Page drafts and enforce approval process on publishing Page rating and bookmarks In-page metadata and intuitive search across pages Summary: Handling large electronic documents and other content can be cumbersome and time consuming for businesses, even though it is not as hard as maintaining a large volume of paper piles. SharePoint wiki pages and Enterprise Wiki sites are a simple yet effective solution that can address majority of these issues.4.3KViews4likes5Comments