External Guest Access to SharePoint Online Subfolders With Restricted Permissions
Learn why external guests may still see restricted SharePoint Online subfolders and how to properly secure unique permissions, remove parent sharing, and share only the folders they should access.
Can External Guests See Restricted SharePoint Online Subfolders?
Yes, this can happen in SharePoint Online.
If a parent folder in a document library is shared with an external guest, that sharing can sometimes give the guest access to child folders as well, even when those subfolders have broken inheritance and appear to have restricted permissions. In many cases, the issue is not that SharePoint is ignoring permissions entirely, but that the parent-level sharing grant is still allowing access in a way that overrides your intended folder structure.
This is a common point of confusion for SharePoint administrators and site owners who expect unique permissions on a subfolder to block access automatically. In practice, SharePoint permissions can be layered, and sharing often adds access rather than removing it.
Why This Happens
In SharePoint Online, when you share a parent folder with an external user, that access can extend into the folder structure below it. Even if a subfolder has unique permissions, the guest may still be able to open it if access was granted at a higher level.
This usually happens because:
- the parent folder is still shared with the guest
- a sharing link is active on the higher-level folder
- the guest has direct access through the parent structure
- unique permissions on the subfolder do not fully override the parent sharing grant
In simple terms, if the guest has access to the container above the restricted folder, they may still be able to reach content inside it.
This might interest you - How to Configure SharePoint Online Auditing
How to Secure the Restricted Subfolder
If your goal is to let an external guest access only specific subfolders and hide the restricted ones, the safest method is to avoid sharing the parent folder at all.
Best Practice Approach
- Remove external access from the parent folder
- Open the parent folder’s Manage access pane.
- Remove the guest from Direct access.
- Delete any active sharing links, including Anyone, People in your organization, or Specific people links.
- Keep restricted subfolders on unique permissions
- Confirm the restricted subfolder does not inherit from the parent.
- Make sure only the intended groups or users are listed.
- Remove any access paths that could include the guest indirectly.
- Share only the folders the guest should see
- Share the allowed subfolders directly instead of the top-level folder.
- Use Specific people links for tighter control.
- Give only the minimum required permission, such as View.
- Verify permissions
- Use Manage access to confirm the guest only has access to the intended folders.
- Use Check permissions to verify the restricted subfolder does not grant access to the guest.
Recommended Folder Sharing Design
If you regularly work with external guests, the cleanest design is to place guest-facing content in a separate structure or even a dedicated library. That way, you can avoid mixing internal-only content with externally shared content in the same parent folder.
This helps you:
- reduce accidental exposure
- simplify permission management
- make troubleshooting easier m .c
- keep shared content clearly separated from restricted content
Example Scenario
Imagine a parent folder contains 8 subfolders:
- 6 folders should be shared with an external guest
- 2 folders should remain internal-only
If you share the parent folder, the guest may still be able to see the restricted 2 folders.
The better approach is to:
- remove the parent-level share
- keep the 2 restricted folders on unique internal permissions
- share only the 6 permitted folders directly with the guest
That way, the external user sees only what they are meant to see.
Key Takeaway
SharePoint Online permissions are easier to control when sharing is done at the lowest possible level. If a parent folder is shared externally, subfolder restrictions may not behave the way you expect. To properly secure restricted content, remove parent sharing and share only the folders the guest should access.
Check this guide to View SharePoint Online Audit Log Reports
FAQ
Why can an external guest see a restricted SharePoint subfolder?
Because access was likely granted through the parent folder, and SharePoint sharing often adds permissions rather than removing them.
Does breaking inheritance on a subfolder always block external access?
No. If the guest still has access through a parent-level sharing link or direct access, they may still reach the subfolder.
What is the safest way to share folders with external users?
Share only the specific subfolders they need using Specific people links, instead of sharing the parent folder.
Should I use a separate document library for guest content?
Yes, that is often the best practice when you frequently share content externally. It makes permissions easier to manage and reduces the chance of exposing internal files.
How do I confirm a guest cannot access a restricted folder?
Check the folder’s Manage access and use Check permissions to verify the user has no direct or inherited access.
Conclusion
If external guests can see restricted SharePoint Online subfolders, the issue is usually tied to parent-level sharing. The most reliable fix is to remove the guest’s access from the parent folder, keep restricted subfolders on unique permissions, and share only the exact folders the guest needs.
For long-term control, consider separating external sharing into its own folder structure or library so permissions stay clear and secure.