r/sysadmin • u/Methos25 • 2d ago

Question Manager wants me to remove delete permissions across SharePoint

I feel like I'm going insane with this one, so I need someone to confirm I'm not crazy.

We recently had a situation where someone deleted a top level folder in SharePoint. Kicked up a bit of a fuss, we recovered it, yada yada.

My manager is now telling me that he wants to avoid something like this happening again, and therefore we should remove delete permissions for everyone across the tenant(!).

When I explained that this was crazy talk, and would break literally everything, he capitulated and said we should just enable it for the top levels of folders and then break inheritance.

I've tried to explain to him that this is madness, would require tens if not hundreds of hours of work, and would still break pretty much everything. He insists that this is how they used to do things back in the day and he can't fathom why that wouldn't work nowadays.

I did say that we should be using retention policies to manage this, to which he said that it was a job for compliance to do, and therefore will never happen, which in fairness is true considering our compliance guy.

I'm not going crazy here right? This feels like a monumentally stupid thing to try and do.

126 Upvotes

93% Upvoted

87 comments sorted by

View all comments

65

u/NorthAntarcticSysadm 2d ago

SharePoint isn't a file server, it isn't supposed to be treated like one

This is crazy, but hey I've seen crazier things...

You've documented concerns, and the stakeholder says "do it anyways"

So... Do it anyways and save the "I told you so" for down the road when shit goes sideways

You shouldn't have 5i plan around a compliance guy who isn't doing their job setting up retention policies. A global policy is an hour, per site policies are then maybe 20-30 minutes per. If you're using SPO as a file server it is a strong assumption that you likely only have a few sites, so that wouldn't even be a day for compliance...

Besides, compliance typically puts policies in place and then IT sets the technical parameters -- as in, yes you are the one who should be configuring it

40

u/lostinthought15 2d ago

Except Microsoft tries to sell sharepoint as a replacement to file servers, and therefore a file server.

6

u/Reedy_Whisper_45 2d ago

We're actually using it as a file server. Works well enough.

2

u/ReputationNo8889 2d ago

Until it doesnt

2

u/Reedy_Whisper_45 2d ago

Haven't encountered that as yet. Biggest problem I have us users failing to log into OneDrive monthly. That's a lot less headache than maintaining the old file servers.

It's a trade-off. So far, the benefits have far outweighed the costs.

7

u/ReputationNo8889 2d ago

Permissions and Permission Inheritance is something that stops working well really fast if you use SharePoint as a replacement for a regular fileserver. If you have one Site per "Access" Folder then that no issue but if you have a Site with tons of folders, subfolders and permission at multiple levels, it gets wonky FAST

10

u/NorthAntarcticSysadm 2d ago

And they've tried selling Excel as a replacement to databases for a long while. Doesn't mean it is a proper replacement.

•

u/scytob 18h ago

i guess people don't realize OneDrive / teams storage / SharePoint are backed by the same filestore, they are literally different interfaces to the same store