Shared Drives and Permissions Done Right: A Practical Guide for Businesses

Shared drives make collaboration easier, but poor permission management can quickly create security, compliance and productivity problems.

When access is not planned properly, employees may see confidential files they do not need, former staff may retain access, important documents may be deleted accidentally, and teams may create multiple competing versions of the same file.

The solution is not to stop sharing. It is to design shared storage around clear ownership, role-based access and regular reviews.

This guide explains how to manage shared drives and permissions properly, including folder structure, access levels, external sharing, employee departures, confidential data and common mistakes to avoid.

What Is a Shared Drive?

A shared drive is a central storage location used by several people.

Depending on the platform, this may include:

• Microsoft SharePoint document libraries
• Microsoft Teams files
• Google Shared Drives
• Network file servers
• Network-attached storage
• Cloud file-sharing platforms
• Departmental folders
• Project workspaces

The main purpose is to give authorised users access to the same information without relying on email attachments or files stored on individual computers.

A well-managed shared drive provides:

• Central access
• Consistent file locations
• Easier collaboration
• Version history
• Better backup coverage
• Improved business continuity
• Clearer document ownership
• Controlled external sharing

A poorly managed shared drive becomes a digital filing cabinet with no labels, no locks and no clear owner.

Why Permissions Matter

Permissions determine who can:

• View files
• Open folders
• Edit documents
• Upload content
• Delete files
• Share information
• Change access settings
• Restore or permanently remove data

Excessive permissions increase risk. Permissions that are too restrictive create delays and force staff to work around the system.

The goal is to give users the access they need to do their jobs—nothing more and nothing less.

This principle is often called least privilege.

The Principle of Least Privilege

Least privilege means that each person receives only the minimum access required for their role.

For example:

• A sales employee may need access to customer proposals.
• They may not need access to payroll.
• A finance manager may edit financial records.
• A department employee may only need to view approved budgets.
• A contractor may need one project folder.
• They should not have access to the complete company drive.

Least privilege limits the damage caused by:

• Account compromise
• Accidental deletion
• Human error
• Malicious activity
• Incorrect sharing
• Ransomware

Access can always be increased later when there is a valid business need.

Start With Business Functions

Do not build the shared drive around individual employees.

People join, change roles and leave. Business functions remain more stable.

A sensible top-level structure might include:

Company Shared Files

├── Finance

├── Human Resources

├── Sales

├── Marketing

├── Operations

├── Projects

├── Policies and Procedures

└── General Staff Resources

Each department or function should have:

• A clear owner
• A defined purpose
• Approved membership
• Appropriate access levels
• A review schedule

Avoid creating top-level folders named after current employees.

Separate General and Confidential Information

Not every document needs the same level of protection.

A practical structure may include:

Human Resources

├── General HR Resources

├── Recruitment

├── Employee Records

├── Payroll

└── Management Confidential

General policies may be available to all staff, while payroll and employee records require tightly restricted access.

Similarly:

Finance

├── Approved Budgets

├── Supplier Information

├── Accounts Payable

├── Accounts Receivable

├── Banking

└── Board Reports

Do not grant access to the entire Finance area simply because someone needs one approved spreadsheet.

Use Security Groups Instead of Individual Permissions

Permissions are easier to manage when they are assigned to groups.

For example:

• All Staff
• Finance Team
• Finance Managers
• HR Team
• Sales Team
• Project Alpha Members
• Senior Leadership
• External Auditors

Instead of granting access separately to ten employees, add those employees to the appropriate group and assign permission to the group.

Benefits include:

• Faster onboarding
• Easier role changes
• Cleaner audits
• Simpler employee departures
• Fewer forgotten permissions
• More consistent access

Direct permissions should be the exception, not the default.

Use Role-Based Access Control

Role-based access control assigns permissions according to a person’s job role.

For example:

Technical administrators may need the ability to manage systems, but they should not automatically browse confidential business content without a valid reason.

Understand Common Permission Levels

The names vary by platform, but common access levels include:

View

Users can open and read files but cannot change them.

Suitable for:

• Published policies
• Reference materials
• Approved reports
• External reviewers

Comment or Review

Users can add feedback without directly changing the original content.

Suitable for:

• Draft policies
• Proposals
• Design reviews
• Document approvals

Edit

Users can modify, upload and often delete content.

Suitable for:

• Active departmental work
• Collaborative project folders
• Working documents

Manage or Full Control

Users can change permissions, delete folders and control the workspace.

This should be limited to designated owners or administrators.

Too many users with full control is one of the most common shared-drive risks.

Separate Ownership From Everyday Editing

Every shared area should have at least one business owner.

The owner is responsible for:

• Approving access
• Reviewing membership
• Confirming the folder’s purpose
• Archiving old content
• Identifying confidential information
• Removing obsolete data
• Responding to permission requests

The owner does not need to complete every technical change personally. IT may implement the access, but the business owner should decide who genuinely needs it.

Avoid Permission Inheritance Chaos

Many shared storage platforms use permission inheritance.

This means a subfolder automatically receives access rules from its parent folder.

Inheritance is useful because it keeps permissions consistent. However, users often break inheritance repeatedly to create exceptions.

This can result in:

• Hundreds of unique permission sets
• Users with unexpected access
• Administrators unable to explain who can see what
• Permissions that are difficult to remove
• Sensitive files exposed accidentally

Keep inheritance wherever possible.

When a folder needs substantially different access, consider creating a separate document library, shared drive or top-level workspace instead of adding endless exceptions.

Do Not Store Everything in One Shared Folder

A single company folder with everyone set to Edit may seem simple, but it creates serious problems.

Users may:

• Delete each other’s files
• Move folders accidentally
• See confidential information
• Create inconsistent structures
• Share sensitive documents externally
• Synchronise enormous amounts of unnecessary data

Separate content by function, sensitivity and purpose.

Use Clear Naming Standards

Shared folders should be easy to understand without opening them.

Good names include:

• Customer Proposals
• Approved Marketing Assets
• 2026 Budgets
• Board Reports
• Active Projects
• Archived Projects
• Staff Policies

Avoid:

• Stuff
• Misc
• New Folder
• Documents
• Carl’s Files
• Final Versions
• Other

A clear folder name reduces mistakes and makes permission reviews easier.

Keep the Folder Structure Shallow

Deep folder structures become difficult to navigate.

Avoid:

Company

└── Departments

    └── Operations

        └── Documents

            └── Projects

                └── Current

                    └── Yorkshire

                        └── Customer A

A simpler structure is easier:

Projects

└── Customer A

    ├── Commercial

    ├── Technical

    ├── Meetings

    └── Deliverables

Use search, metadata and consistent filenames instead of excessive folder depth.

Use Separate Areas for Working and Approved Documents

Working files change frequently. Approved files should be more controlled.

A practical structure might be:

Policies

├── Drafts

├── Under Review

└── Approved

Permissions could be:

• Drafts: policy team can edit
• Under Review: reviewers can comment
• Approved: all staff can view, limited users can edit

This prevents employees from using unfinished documents as if they were official.

Control Deletion Rights

Edit permission often includes the ability to delete files.

That may be appropriate for trusted team members, but not every user needs it.

Where the platform allows, separate:

• Editing
• Deleting
• Sharing
• Permission management

Also confirm that:

• Version history is enabled
• Recycle bins are available
• Backups are functioning
• Restoration procedures are documented

Recycle bins are helpful, but they are not a complete backup strategy.

Shared Drives Are Not Automatically Backups

Cloud platforms and file servers improve resilience, but they do not eliminate the need for backup.

Data may still be lost through:

• Accidental deletion
• Ransomware
• Synchronised corruption
• Malicious users
• Retention expiry
• Administrator mistakes
• Platform problems
• Account compromise

A reliable backup should provide:

• Independent copies
• Version history
• Recovery from deletion
• Protection from ransomware
• Tested restoration
• Appropriate retention

Do not assume that synchronisation is the same as backup.

Be Careful With External Sharing

External sharing is useful for customers, suppliers and contractors, but it must be controlled.

Before sharing externally, confirm:

• Who the recipient is
• What they need to access
• How long they need access
• Whether editing is necessary
• Whether downloading is allowed
• Whether the file contains personal or confidential data
• Whether the organisation permits external sharing

Use the smallest possible scope.

Share one folder or file rather than an entire department workspace.

Avoid “Anyone With the Link” for Sensitive Data

Anonymous links are convenient because recipients do not need to sign in.

They also create risk because the link can be forwarded.

Avoid anonymous links for:

• Customer records
• Contracts
• Financial information
• Employee data
• Security documents
• Identification records
• Confidential project files

Prefer named-user access with authentication.

Use Expiry Dates for External Access

Where supported, set an expiry date.

Examples include:

• Contractor access ends when the project finishes.
• Auditor access expires after the review.
• Customer download access expires after 30 days.
• Temporary supplier access expires after a submission deadline.

Temporary access should not become permanent simply because nobody remembered to remove it.

Use Read-Only Access Where Possible

An external user often needs to read or download a document, not edit it.

Use View rather than Edit when practical.

For collaborative work, consider a separate project workspace containing only the documents needed by external participants.

Do Not Share From Personal Accounts

Business files should not be shared from:

• Personal Gmail accounts
• Personal Microsoft accounts
• Personal Dropbox accounts
• Employee-owned storage
• Consumer file-transfer services

This creates problems when:

• The employee leaves
• The account is compromised
• The company needs to recover access
• Retention rules must be applied
• A data request is received
• Ownership is disputed

Store and share business information through company-managed systems.

Avoid Email Attachments for Collaborative Documents

Email attachments create multiple uncontrolled copies.

Users may edit different versions and produce filenames such as:

Proposal Final.docx

Proposal Final Updated.docx

Proposal Final Updated 2.docx

Proposal FINAL FINAL.docx

Instead, store the document centrally and share a link.

This provides:

• One current version
• Version history
• Clear access control
• Easier revocation
• Less inbox duplication
• Better collaboration

Use Version History

Version history allows users to:

• Review previous changes
• Restore an earlier version
• See who made an edit
• Recover from accidental overwriting
• Compare revisions

Version history is particularly useful for:

• Policies
• Proposals
• Budgets
• Reports
• Project documents
• Contracts before signing

Do not use version history as an excuse to avoid proper backups or document approval.

Lock Down Highly Sensitive Areas

Some information should use stronger controls.

Examples include:

• Payroll
• Employee medical information
• Disciplinary records
• Banking details
• Legal cases
• Merger plans
• Security credentials
• Board communications

Additional controls may include:

• Separate storage locations
• Smaller security groups
• Multi-factor authentication
• Download restrictions
• Device requirements
• Sensitivity labels
• Audit logs
• Data-loss prevention
• Encryption
• Shorter session times

Access should be reviewed more frequently than normal departmental storage.

Never Store Passwords in Normal Shared Documents

Do not keep passwords in:

• Word documents
• Excel spreadsheets
• Shared text files
• Team notes
• Email drafts

Use a business password manager designed for secure credential sharing.

A shared spreadsheet named Passwords.xlsx is not a secure password-management system.

Plan Employee Onboarding

New staff should receive access based on their role.

A good onboarding process includes:

1. Confirm the employee’s department and role.
2. Add them to approved security groups.
3. Grant only required access.
4. Provide training on file locations and sharing.
5. Explain confidential-data rules.
6. Confirm multi-factor authentication.
7. Record any exceptional permissions.

Avoid copying every permission from another employee without checking whether the roles are genuinely identical.

Plan Role Changes

When someone moves department or takes on a new role, old access is often forgotten.

A role-change process should:

• Add the necessary new permissions
• Remove previous department access
• Review confidential folders
• Transfer document ownership
• Update distribution groups
• Review external workspaces

Access should follow the current role, not the employee’s entire employment history.

Remove Access Promptly When Staff Leave

Offboarding should include:

• Disabling the account
• Removing group memberships
• Revoking active sessions
• Removing external access
• Transferring ownership
• Preserving required business files
• Reviewing shared links
• Checking delegated access
• Rotating shared credentials

Do not simply delete the account immediately without preserving business records.

At the same time, do not leave inactive accounts enabled “just in case”.

Review Permissions Regularly

Permission reviews should not be a one-time task.

Review at least:

• Quarterly for sensitive areas
• Every six or twelve months for general departmental storage
• When projects end
• When staff change roles
• After organisational changes
• After a security incident
• Before compliance audits

Each review should ask:

• Does this person still need access?
• Is the access level appropriate?
• Are there external users?
• Are anonymous links active?
• Does the folder still have an owner?
• Are former employees present?
• Are direct permissions being used unnecessarily?

Produce Access Reports

Many business platforms provide reports showing:

• Site owners
• Group members
• External users
• Shared links
• Recent activity
• Permission changes
• File access
• Downloads

These reports are useful for audits, but they need interpretation.

A list of users does not automatically explain why each person has access.

Document the business reason for important permissions.

Audit External Links

External sharing links can survive long after the original need has ended.

Regularly review:

• Anonymous links
• Guest-user access
• Links with no expiry
• Links created by former staff
• Publicly accessible files
• Externally shared folders
• Sensitive files shared outside the organisation

Revoke links that are no longer required.

Use Multi-Factor Authentication

Shared-drive security depends on account security.

When a user account is compromised, the attacker may gain access to every file that user can reach.

Use multi-factor authentication for:

• Employees
• Administrators
• Contractors
• External guests where supported

Also use strong access policies for sensitive data.

Manage Synchronized Folders Carefully

Cloud drives may synchronise files to laptops and desktops.

This improves convenience but creates risks:

• Confidential files remain on unmanaged devices.
• Large libraries consume storage.
• Ransomware changes synchronise to the cloud.
• Deleted folders disappear elsewhere.
• Staff synchronise information they do not need.

Limit synchronisation of sensitive or extremely large libraries.

Require managed devices where appropriate.

Set Device Requirements

Sensitive data should not be accessible from any unmanaged computer simply because the user knows their password.

Depending on the platform, controls may require:

• Company-managed devices
• Device encryption
• Screen locks
• Current security updates
• Approved antivirus or endpoint protection
• Compliant operating systems
• Restricted browser sessions
• Download blocking on unmanaged devices

This is especially important for remote working and external contractors.

Use Sensitivity Labels Where Available

Sensitivity labels can classify files as:

• Public
• Internal
• Confidential
• Highly Confidential

Labels may apply protections such as:

• Encryption
• Access restrictions
• Watermarks
• Sharing limitations
• Download controls

Classification works best when employees understand the categories.

Do not create so many labels that users cannot choose correctly.

Use Data-Loss Prevention

Data-loss prevention policies can detect or restrict sensitive information such as:

• Bank details
• National Insurance numbers
• Passport numbers
• Payment-card data
• Health information
• Customer identifiers

Policies may:

• Warn users
• Block external sharing
• Require justification
• Notify administrators
• Log activity

These controls support good permissions but do not replace careful access design.

File Ownership Must Belong to the Business

Files stored only in an employee’s personal workspace may become difficult to manage when the employee leaves.

Important business records should live in:

• SharePoint sites
• Google Shared Drives
• Team workspaces
• Departmental file servers
• Managed project repositories

Personal storage can be suitable for drafts, but completed business files should move to the relevant shared location.

Google Shared Drives vs. Personal My Drive

In Google Workspace, files in a Shared Drive belong to the organisation rather than an individual user.

This can improve continuity when employees leave.

Organisations should still:

• Control who can manage members
• Restrict external sharing
• Use appropriate member roles
• Review memberships
• Separate confidential areas
• Apply retention and backup policies

Do not treat one Shared Drive as the correct location for every company file.

Microsoft Teams and SharePoint Permissions

Files uploaded to a standard Teams channel are normally stored in the connected SharePoint site.

Private and shared channels may use separate storage and membership rules.

Common risks include:

• Assuming every channel has the same permissions
• Sharing a SharePoint folder without understanding Teams access
• Adding guests to a team with excessive content
• Breaking inheritance repeatedly
• Giving too many users Site Owner access

Understand where the files are stored and which group controls access.

Network File Servers Still Need Governance

Traditional shared drives such as:

S:\Finance

P:\Projects

H:\HR

require the same principles.

Use:

• Active Directory security groups
• Departmental ownership
• Read and modify groups
• Separate confidential areas
• Regular access reviews
• Backups
• Auditing
• Clear folder structures

Avoid granting permissions directly to individual user accounts unless necessary.

Read vs. Modify Groups on File Servers

A simple pattern is:

• Finance_Read
• Finance_Modify
• Finance_Managers

Users who need reference access join the Read group.

Users working with the files join Modify.

Managers may receive wider access or approval rights.

This structure is easier to understand than a long list of individually assigned permissions.

Protect Against Ransomware

Ransomware can encrypt shared files using the permissions of the infected user.

Reduce exposure by:

• Applying least privilege
• Limiting broad write access
• Using endpoint protection
• Keeping systems patched
• Blocking risky file types where appropriate
• Maintaining independent backups
• Monitoring mass file changes
• Using version history
• Training staff against phishing

A user with read-only access cannot encrypt files they cannot modify.

Archive Completed Projects

Project workspaces should not remain permanently active.

When a project ends:

1. Confirm the final documents.
2. Remove temporary users.
3. Revoke contractor access.
4. Make the archive read-only where appropriate.
5. Apply retention rules.
6. Record the owner.
7. Delete temporary working files when permitted.
8. Move final records to an archive location.

Archiving reduces clutter and prevents old projects being mistaken for current work.

Apply Retention Policies

Not every file should be kept forever.

Retention may depend on:

• Legal requirements
• Contractual obligations
• Tax rules
• Employment law
• Industry standards
• Customer agreements
• Business needs

A retention policy should define:

• What must be kept
• How long it must be kept
• Who owns it
• When it can be deleted
• Whether deletion must be suspended
• Where archived records are stored

Permissions and retention should work together.

Do Not Use Shared Drives as a Dumping Ground

Common clutter includes:

• Old desktop backups
• Personal photos
• Duplicate downloads
• Temporary exports
• Software installers
• Unapproved tools
• Multiple copies of the same report
• Files with no owner

Set rules for what belongs in shared storage.

Provide separate locations for:

• Working documents
• Published documents
• Archives
• Templates
• Temporary transfers

Use Consistent File Names

A useful filename might include:

2026-08-02 Northside Ltd Project Proposal v1.0.docx

Avoid:

Proposal final new latest 2.docx

Naming standards improve:

• Search
• Sorting
• Version recognition
• Records management
• Handover
• Auditing

Do not rely entirely on filenames for version control where the platform already provides version history.

Create a Permission Request Process

Employees should know how to request access.

A good request includes:

• User name
• Folder or site
• Required permission level
• Business reason
• Duration
• Manager approval
• Data owner approval where necessary

Avoid informal requests such as:

“Can you give me access to everything Finance has?”

The request should identify the specific need.

Time-Limit Exceptional Access

Temporary or elevated access should expire.

Examples include:

• Project cover during annual leave
• Short-term audit access
• Temporary management responsibilities
• Incident-response access
• Contractor access

Record the end date when access is granted rather than relying on someone to remember later.

Train Staff to Share Safely

Employees should understand:

• The difference between a file and a link
• View vs. Edit access
• Internal vs. external sharing
• Anonymous-link risks
• How to check recipients
• How to stop sharing
• Where confidential information belongs
• Why business files must not be stored in personal accounts
• How to report an accidental disclosure

Technology controls are important, but user decisions still matter.

Common Shared-Drive Permission Mistakes

Giving Everyone Full Control

This allows users to change permissions and delete critical content.

Assigning Permissions Individually

Access becomes difficult to audit and maintain.

Copying Another Employee’s Access

The users may have different responsibilities.

Breaking Inheritance Everywhere

The permission structure becomes impossible to understand.

Leaving Former Staff and Contractors

Inactive access remains a security risk.

Sharing Whole Sites for One File

The recipient gains far more access than needed.

Using Anonymous Links for Confidential Information

The link can be forwarded.

Failing to Review Access

Old permissions accumulate indefinitely.

Storing Business Files in Personal Drives

Ownership and continuity become unclear.

Assuming Cloud Storage Is a Backup

Deletion and ransomware may still affect data.

Giving Managers Technical Ownership Without Training

They may change permissions accidentally.

Using One Shared Drive for the Whole Company

Sensitive and general content become mixed together.

A Practical Permission Model

A straightforward departmental model might use:

Department Owners

• Approve access
• Manage content structure
• Review memberships
• Control publishing

Department Members

• Edit working files
• Upload documents
• Collaborate

Department Visitors

• Read approved content
• Cannot modify files

External Guests

• Access only to a dedicated external folder
• Expiry date applied
• View-only unless editing is necessary

IT Administrators

• Manage the technical platform
• Use privileged access only when required
• Maintain auditability

Shared Drive Setup Checklist

Before creating the drive:

• Define its business purpose.
• Assign an owner.
• Identify the information it will contain.
• Classify the sensitivity.
• Choose the correct platform.
• Design a simple folder structure.
• Create security groups.
• Decide which users need View, Edit or Manage access.
• Plan external sharing.
• Confirm backup and retention.

After launch:

• Test each permission group.
• Confirm users cannot access restricted folders.
• Train staff.
• Enable version history.
• Review sharing settings.
• Document the owner.
• Set a review date.
• Monitor external access.
• Test file restoration.

Permission Review Checklist

During every review:

• Confirm the business owner.
• List current members.
• Remove former staff.
• Remove completed contractors.
• Check role changes.
• Review direct permissions.
• Review anonymous links.
• Check external guests.
• Confirm access levels.
• Review confidential folders.
• Check temporary access expiry.
• Record the review and approval.

Final Thoughts

Shared drives work best when access is designed deliberately rather than added one user at a time.

Build the structure around departments, projects and business functions. Use security groups and role-based permissions instead of granting access individually. Give users the minimum access they need and reserve full control for a small number of trained owners.

External sharing should be restricted, authenticated and time-limited. Employee access should change when roles change and be removed promptly when someone leaves.

Most importantly, permissions must be reviewed regularly. A shared drive that was secure two years ago may now contain former staff, forgotten contractors and links that nobody remembers creating.

Done properly, shared storage improves collaboration without sacrificing control, security or accountability.

Need Help Managing Shared Drives and Permissions?

Poorly designed shared storage can expose confidential files, create duplicate data and make employee access difficult to manage.

Hamilton Group can help businesses configure Microsoft 365, SharePoint, Teams, Google Workspace and network file permissions, while improving security, backup and document-management processes.

Visit hgmssp.com, call 0330 043 0069, or book a meeting with one of our experts.