SharePoint for Finance Teams: Document Libraries, Permissions and Version History

For many finance teams, SharePoint is where the real work lives: the month-end workbooks, the signed-off board pack, the folder of supporting documents for the auditors. Whether that works well depends on three things Microsoft's documentation covers directly: who can open what (permissions), how earlier copies are kept (version history), and what happens when records must be kept or deleted (retention). This guide summarises those pages as Microsoft publishes them and adds a few practical suggestions, clearly labelled as ours. Because permissions also shape what AI assistants can surface, it pairs well with our guide to Microsoft 365 Copilot data governance and permissions for Irish employers.

Menus, names and availability change by version and by what your administrator has enabled, so check the current Microsoft documentation before acting. This post does not cover licensing or pricing. It also does not tell you what records you must keep by law; that is a separate question.

Permissions: inheritance and unique permissions

Microsoft's support article "Customize permissions for a SharePoint list or library" (content dated February 2026, updated August 2026) explains that sites, lists, libraries, folders and documents inherit permissions from the level above them. Inheritance saves time, but you may want to change it to share access with others or to restrict it.

The article describes the following:

• On the library's Permissions page you can choose "Stop Inheriting Permissions". After that, the library becomes the parent for its items, which inherit its settings unless they have their own permissions.
• Sharing a document or item automatically breaks inheritance for that item.
• Once inheritance is broken, the default permission level when granting access is Edit; you can choose Read or another level.
• "Delete unique permissions" restores inheritance and removes all the custom settings.
• Lists or libraries with more than 100,000 items cannot have permissions inheritance broken on the list itself, although individual items under the limit can still have inheritance broken.

Microsoft is cautious about unique permissions. The article says it recommends using built-in SharePoint groups for communication sites and managing team site permissions through the associated Microsoft 365 group. It says breaking inheritance and setting item-level permissions is a supported scenario within reasonable use but is not recommended, and it points to sharing-based methods for easier administration. It also warns that removing a user or group's permissions removes them from all child items, including those with broken inheritance, and that this cannot be undone.

Sharing links

Permissions are only part of the picture, because people can also share files through links. Microsoft's page "How shareable links work in OneDrive and SharePoint in Microsoft 365" (last updated 13 August 2026) describes three link types:

• Anyone: gives access to anyone who has the link, with no authentication required, and access cannot be audited. Microsoft says it cannot be used with files in a Teams shared channel site.
• People in your organization: works only for authenticated members of your Microsoft 365 directory; guests and outsiders cannot use it.
• Specific people: works only for the people the sender names, who can be inside or outside the organisation and must authenticate as the specified user.

The page adds that Anyone and People in your organization links are transferable, while Specific people links are not. Your administrator controls which link types are available, so ask what your tenant allows before assuming a particular option exists.

Version history

Microsoft's support article "Enable and configure versioning for a list or library" (content dated November 2024, updated August 2026) says versioning lets you track changes over time: after changes are saved, a new version is stored in the item's history so you can view and recover earlier versions. For document libraries you can choose to create a version each time a file is edited, using either major versions only or both major and minor versions, and you can set who can see draft items. You can also limit the number of versions and drafts retained.

The documented steps are at a high level: open the library, go to Library Settings, choose Versioning settings, set the options (content approval, version creation, version limits, draft visibility and, for libraries, required check-out), and select OK. To view, restore or delete an earlier version, you open Version history from the item's menu and choose from the options offered for that version.

A separate page, "Set version limits for a document library" (last updated 8 January 2026), explains that limits can be automatic or manual. It says new libraries take their default limits from the organisation-level or site-level settings, and that lowering a count limit does not purge versions immediately: excess versions are trimmed gradually as files are updated. It also says changing an expiration setting applies only to newly created versions. Site admins can configure versioning for a library, and the PowerShell route requires the SharePoint Administrator role.

Our suggestion: before a limit is changed on a library that holds finance workbooks, ask who might need an older version later, such as for an audit query, and agree the setting with whoever owns the library.

Retention labels and how they interact with versions

Retention is a different tool from version history. Microsoft's Purview page "Learn about retention for SharePoint and OneDrive" (last updated 22 September 2025) says files stored in SharePoint or OneDrive sites can be retained by applying a retention policy or a retention label. It explains that SharePoint creates a hidden Preservation Hold library where a copy of retained content is kept when a user edits or deletes it, depending on the type of policy or label. It adds that new content is not copied to the Preservation Hold library the first time it is edited, and that to retain all versions of a file, versioning must be turned on for the site.

The same page says versioning limits are ignored for items under a retention policy or eDiscovery hold until the retention period ends, whereas for items under a retention label that is not a record, versioning limits are honoured. It also describes recycle bin stages and says a 93-day period spans the first- and second-stage recycle bins, at the end of which the document is permanently deleted. Read the page itself before designing a scheme, because the details differ for retain-only, delete-only and retain-and-delete settings.

Microsoft's support article "Apply retention labels to files in SharePoint or OneDrive" says you can apply a label to an individual item or set a default label for a library, and that a file-level label can override a library default. Some labels mark an item as a record, which can prevent deletion, and users can sometimes unlock a record to revise it. The article warns that if versioning is off and a record starts unlocked, you can lock it but cannot unlock it again.

Which labels you need, and for how long, depends on your own obligations. For the employment side, see our guide to employment records retention periods in Ireland; this post does not state any retention period.

Practical suggestions for finance teams

These are our suggestions, not Microsoft requirements or legal rules.

• Keep the structure simple. A small number of libraries with clear names is easier to secure than many folders with special access.
• Prefer groups to individuals. Microsoft's guidance leans on groups; granting access to named individuals item by item is hard to review later.
• Treat unique permissions as an exception. If you break inheritance, write down why and who owns the exception.
• Review sharing links. Periodically check which items have been shared outside the team.
• Record where personal data sits. If libraries hold personal data, make sure your records of processing reflect it; our guide to GDPR records of processing under Article 30 explains that exercise.
• Agree a naming and ownership convention so that each library has a named owner who is responsible for permissions, versioning and retention settings.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Is version history the same as a backup?

No. Microsoft describes versioning as storing earlier versions of an item so you can view and recover them, and it lets you limit how many are kept. Retention is a separate mechanism, and the retention page explains how the two interact. Neither page presents versioning as a substitute for your organisation's wider recovery arrangements.

Should we break permission inheritance on a sensitive folder?

Microsoft says it is a supported scenario within reasonable use but not recommended. If you do it, document the reason and review it regularly. A separate library or site with its own membership can be easier to manage; that is our suggestion.

Does sharing a file change its permissions?

Microsoft's permissions article says sharing a document or item automatically breaks inheritance for that item, so shared items can end up with different access from the rest of the library.

Can a retention label stop someone deleting a file?

Microsoft says some labels mark an item as a record that must be preserved, which can prevent deletion, and the retention page describes when users see errors deleting labelled items. The exact behaviour depends on how the label and your tenant are configured.

Where do I check what applies to my organisation?

Start with your SharePoint or Microsoft 365 administrator, then the current Microsoft pages named above. Defaults and limits are set by the organisation and change over time.

In short: use groups, keep exceptions rare, set version limits knowingly, and treat retention as a policy decision rather than a technical setting.