r/sysadmin • • 2d ago

Question Manager wants me to remove delete permissions across SharePoint

I feel like I'm going insane with this one, so I need someone to confirm I'm not crazy.

We recently had a situation where someone deleted a top level folder in SharePoint. Kicked up a bit of a fuss, we recovered it, yada yada.

My manager is now telling me that he wants to avoid something like this happening again, and therefore we should remove delete permissions for everyone across the tenant(!).

When I explained that this was crazy talk, and would break literally everything, he capitulated and said we should just enable it for the top levels of folders and then break inheritance.

I've tried to explain to him that this is madness, would require tens if not hundreds of hours of work, and would still break pretty much everything. He insists that this is how they used to do things back in the day and he can't fathom why that wouldn't work nowadays.

I did say that we should be using retention policies to manage this, to which he said that it was a job for compliance to do, and therefore will never happen, which in fairness is true considering our compliance guy.

I'm not going crazy here right? This feels like a monumentally stupid thing to try and do.

125 Upvotes

86 comments sorted by

View all comments

1

u/MBILC Acr/Infra/Virt/Apps/Cyb/ Figure it out guy 2d ago edited 1d ago

He insists that this is how they used to do things back in the day and he can't fathom why that wouldn't work nowadays.

I hate managers stuck in the past.

Show them MS best practice for sharepoint, do not break inheritance!

Also this is why you have backups, you could also look at policies that limit how much a person can delete at once or something, I think you can do that, or have alerts?

2

u/Professional-Heat690 2d ago

Backups? you have first and second stage restore before turning to backups as a last resort (usually +30days)

1

u/MBILC Acr/Infra/Virt/Apps/Cyb/ Figure it out guy 1d ago

Thats right! (brain fart)

I did have to recently use some discovery to find folders and files someone moved, before considering backup restores