How to Set Up SharePoint for a Small Business: Sites, Permissions and Sharing

To set up SharePoint for a small business, decide your structure before you click Create site: one team site per department or project, a communication site for company news, and a hub to connect them. Manage access through Microsoft 365 groups, tighten external sharing defaults in the SharePoint admin center, then move files in waves.

SharePoint comes with Microsoft 365 Business Basic, Standard and Premium, so most small businesses already pay for it. Getting it right is about structure and permissions more than clicks. Our SharePoint intranet consulting designs that structure with you, and our SharePoint migration service moves the file server into it. Here is the order we follow.

Team site, communication site or hub: which do you need?

How do you create a site in SharePoint?

Microsoft's steps take a few minutes:

1. On the SharePoint start page, select + Create site.
2. Choose Team site or Communication site, pick a template and select Use template.
3. Enter the site name, and edit the description, site address and, for a team site, the group email address if needed. The only symbols the address accepts are underscores, dashes, single quotes and periods.
4. Set the privacy setting and default language, select Create site, add owners and members, and select Finish.

Creating a team site also creates a Microsoft 365 group. By default, any user can create communication sites and group-connected team sites. If you want IT to approve new sites, turn off Users can create SharePoint sites in the SharePoint admin center, and limit who can create Microsoft 365 groups too, because every new group or team brings its own site.

How should a small business structure SharePoint?

Keep it flat. Microsoft's planning guidance gives each unit of work its own site and recommends hubs instead of subsites, because subsites are fixed in the URL and break when the business reorganizes. A hub links sites without nesting them. A tenant can have up to 2,000 hubs; a small business usually needs one.

Here is an illustrative planning example for a 25-person firm, not a client's setup:

• A communication site as the company home page and hub, holding news, policies, forms and links
• Team sites for Finance, Operations and Sales, each with its own Microsoft 365 group
• A separate HR site with external sharing turned off
• One site for sharing files with clients or partners, where guest access is allowed and reviewed

Agree a naming pattern, such as a department or client prefix, before people start creating sites. A Microsoft 365 group naming policy can enforce prefixes, suffixes and blocked words; it requires Entra ID P1, which Business Premium includes.

How should SharePoint permissions work?

Grant access to sites, not scattered files, and give each person only the access their work needs (the principle of least privilege). Microsoft recommends managing team site permissions through the Microsoft 365 group: group owners become site owners and members become site members. If the site belongs to a team in Teams, manage membership in Teams. Microsoft 365 groups have no view-only role, so add read-only users to the site's Visitors group.

Communication sites use the Owners, Members and Visitors groups directly, and security groups work well in Visitors for large audiences. Avoid breaking inheritance on folders and files to fix one-off requests. It is hard to audit, and SharePoint will not let you break inheritance on a list, library or folder holding more than 100,000 items. When content needs different access, give it a different site. For confidential information, Microsoft's advice is a site with external sharing turned off.

Which sharing settings should you change first?

External sharing is on by default. Set the organization level in the SharePoint admin center under Policies > Sharing; each site can then match it or be stricter, never looser.

Then change the default link from Anyone to Specific people or Only people in your organization, set guest access to expire after a set number of days, and limit sharing to approved partner domains if you work with a fixed set of firms.

How do you set up document libraries and metadata?

Add libraries when content needs different settings, such as contracts versus marketing files, rather than piling everything into one. Inside a library, use a few columns (client, year, document type) instead of deep folder trees, and let views and filters do the sorting. Two limits matter on a file server move: the full path, including the file name, cannot exceed 400 characters, and a library holds up to 30 million files and folders.

How do you move files off a file server?

Clean up before you copy. Archive what nobody has opened in years, shorten paths that will run past the limit, and map every top-level folder to a site and library with a named owner. Microsoft's Migration Manager, in the SharePoint admin center, runs the copy through agents installed on your servers; it needs SMB 2.0 or later on the source and handles files up to 250 GB.

We move in waves, run an incremental pass to catch late changes, then set the old share to read-only. Storage is pooled: business plans get 1 TB plus 10 GB per license for the whole organization, so check the total first. Our guides to Microsoft 365 storage limits and SharePoint vs OneDrive cover what goes where.

What should you check before turning on Copilot?

Microsoft says Microsoft 365 Copilot only surfaces organizational data that each user has at least view permission to, so any oversharing becomes visible fast. Before rollout, look for sites shared with Everyone except external users, old Anyone links and libraries with broken inheritance. SharePoint's data access governance reports find them, and once your organization assigns a Copilot license, SharePoint admins also get SharePoint Advanced Management tools such as restricted content discovery. Our Copilot oversharing guide has the full checklist.

Frequently asked questions

Is SharePoint included in Microsoft 365?

Yes. SharePoint is included in Microsoft 365 Business Basic, Business Standard and Business Premium, which list at $7.00, $14.00 and $22.00 per user per month as of October 2026, with annual billing. Microsoft designs the business plans for up to 300 users.

How many SharePoint sites does a small business need?

Usually fewer than people expect: a home page that doubles as the hub, one team site per department or group that works together, and a separate site for anything sensitive or shared outside the company. Add a site when access or retention needs differ, not for every folder.

Should files live in SharePoint or OneDrive?

Shared business files belong in SharePoint, where access follows the team and stays put when people leave. OneDrive is for each person's own working files. Our SharePoint vs OneDrive FAQ covers the edge cases.

Sources and further reading

• Microsoft Support: Create a site in SharePoint: the site creation steps.
• Microsoft Learn: Planning your SharePoint hub sites: team, communication and hub sites, and why to avoid subsites.
• Microsoft Learn: Sharing and permissions in the SharePoint modern experience: group-based permissions and link types.
• Microsoft Learn: Manage sharing settings and Manage site creation: sharing levels, default links and who can create sites.
• Microsoft Learn: SharePoint limits: storage, path length, library and hub limits.
• Microsoft Learn: Microsoft 365 group naming policy: prefixes, blocked words and licensing.
• Microsoft Learn: Migration Manager: moving file shares to Microsoft 365.
• Microsoft Learn: Data access governance reports, SharePoint Advanced Management in Copilot licenses and Copilot data, privacy and security: oversharing checks before Copilot.
• Microsoft 365 business plans: plan prices, checked October 2026.