Default SharePoint groups

The default SharePoint groups are created automatically when you create a site (previously called a "site collection"). The default groups use SharePoint's default permission levels - sometimes called SharePoint roles - to grant users rights and access. The permission levels that these groups have represent common levels of access that users have to have. They're a good place to start when you add users to a SharePoint site.

Administrators can create additional groups to align more closely with specific business needs. Deciding how to design and populate your SharePoint groups is an important decision that affects security for your site and site content.

Here are links to information on understanding and setting SharePoint permissions.

• Understanding permission levels in SharePoint

• Edit and manage permissions for a SharePoint list or library

Permission levels for default SharePoint groups

SharePoint groups enable you to control access for sets of users instead of individual users. SharePoint groups are usually composed of many individual users. They can also hold Microsoft Entra security groups (created in Microsoft 365 or Microsoft Entra ID), or can be a combination of individual users and security groups.

Each SharePoint group has a permission level. A permission level is simply a collection of individual permissions, such as Open, View, Edit, or Delete. All the users in a group automatically have the permission level of the group. You can organize users into any number of groups, depending on the complexity of your organization, or your needs.

Each site template has a set of SharePoint groups associated with it. When you create a site, you use a site template, and SharePoint automatically creates the correct set of SharePoint groups for the site. The specific collection of groups depends on the type of template that you choose.

For example, the following table shows the groups and permission levels that are created for team sites:

SharePoint groups	Default permission level	Applies to team sites
Approvers	Approve	No
Designers	Design, Limited Access	No
Hierarchy Managers	Manage Hierarchy	No
<site name> Members	Edit	Yes
<site name> Owners	Full Control	Yes
<site name> Visitors	Read	Yes
Restricted Readers	Restricted Read	No
Style Resource Readers	Limited Access	No
Quick Deploy Users	Contribute	No
Translation Managers	Limited Access	No

Suggested uses for SharePoint groups

The following table describes the SharePoint groups that are created when you use a standard site template to create a site. The table also provides suggested uses for each group.

Group Name	Permission level	Use this group for
Approvers	Approve	Members of this group can edit and approve pages, list items, and documents.
Designers	Design	Members of this group can edit lists, document libraries, and pages in the site. Designers can create Master Pages and Page Layouts in the Master Page Gallery and can change the behavior and appearance of each subsite by using master pages and CSS files.
Hierarchy Managers	Manage Hierarchy	Members of this group can create sites, lists, list items, and documents.
Owners	Full Control	People who must be able to manage site permissions, settings, and appearance.
Members	Edit or Contribute	People who must be able to edit site content. Permission level depends on the site template that was used to create the site
Visitors	Read	People who must be able to see site content, but not edit it.
Restricted Readers	Restricted Read	People who should be able to view pages and documents but not view versions or permissions.
Style Resource Readers	Restricted Read	People in this group have Limited Access to the Style Library and Master Page Gallery.
Quick Deploy Users	Contribute	These users can schedule Quick Deploy jobs (Content Deployment).
Viewers	View Only	These users see content, but can't edit or download it.

Special SharePoint Groups

"Everyone except external users" is a special group that doesn't appear in the Microsoft 365 admin center, and "Company Administrator" acts like a group but is a role in Microsoft Entra ID.

Everyone except external users All users added to your organization automatically become members of "Everyone except external users". Note that you can't change default permissions granted to "Everyone except external users" on Microsoft 365 group-connected team sites. If a group-connected team site is set to "Public", "Everyone except external users" has a default permission level of "Edit". When a group-connected team site is set to "Private", "Everyone except external users" can be manually added to the site through "Site permissions". To change the privacy setting for a group-connected team site, select the Settings icon, and then select Site information.

Company Administrator This group contains all users who are assigned the global admin role. For more info about this role and its permissions in Microsoft Entra ID, see Company administrator. The root site for your organization is created with "Company Administrator" as the primary admin.

Site administrators

Description	SharePoint in Microsoft 365	SharePoint Server
Who can use this group?	Yes	Yes

A site can have several site admins, but must have one and only one primary administrator. Any site admin can add or remove other admins. Site admins have full control of the site root and any subsites in the site, and can audit all site content.

In SharePoint Server, you designate a site collection administrator when you create a site.

SharePoint admins

Description	SharePoint in Microsoft 365	SharePoint Server
Who can use this group?	Yes	No, by default. Requires special installation.

In SharePoint in Microsoft 365, there's also a SharePoint admin. A SharePoint admin can use the SharePoint admin center or PowerShell to manage settings for all sites. Any global admin in Microsoft 365 also has the permissions of a SharePoint admin. For more info about the SharePoint admin role, see About the SharePoint admin role in Microsoft 365.

If you're using SharePoint Server, you don't have a SharePoint admin or SharePoint admin center.