Why This Still Matters
SharePoint Online continues to default to a simple permission model:
- Owners → Full Control
- Members → Edit
- Visitors → Read
The issue hasn’t changed: Members are typically over-permissioned.
- Edit or delete pages
- Modify navigation and structure
- Impact the overall integrity of the site
In most real-world environments, this behavior is not intentional—and becomes a long-term governance problem.
What Has Changed in Modern SharePoint
The biggest shift is not the problem—it’s how Microsoft expects you to solve it.
- Team sites are now tied to Microsoft 365 Groups
- Permissions are expected to be managed at the Group / Teams level
- Advanced SharePoint permission customization is now considered exception-based
In modern guidance, the model is:
- Identity = Microsoft 365 Group
- Permissions = SharePoint role assignment
This means: Trying to directly modify built-in SharePoint groups is no longer the preferred approach.
The Real Problem Behind “Edit”
In most environments, “Edit” itself is not the issue—the problem is that it includes:
- Full control over Site Pages
- Ability to modify published content
- No approval or governance boundaries
Modern guidance focuses on solving the page integrity problem, not just reducing permission levels.
Modern Recommended Approaches (2026)
1. Protect the Site Pages Library (High Impact)
Instead of redesigning the entire permission model, focus on the area that causes the most risk: Site Pages.
- Go to Site Contents → Site Pages
- Open Library Settings → Permissions
- Set Members to Read (or restrict editing groups)
This prevents page edits while allowing normal collaboration elsewhere.
2. Use Page Approval Workflows
For organizations that allow page editing:
- Enable Page Approvals using Power Automate
- Require approval before publishing
- Add governance without blocking productivity
3. Use Custom Contributor Groups
If stricter control is required:
- Create a group such as Site Contributors
- Assign Contribute permission
- Add users to this group instead of default Members
This avoids modifying system-managed permission objects.
4. Respect the M365 Group Model (Critical)
For Team Sites:
- Manage membership via Teams / M365 Group
- Avoid duplicating identity in SharePoint-only groups
- Understand permissions flow from the group → SharePoint
This keeps permissions consistent across Teams, Planner, Outlook, and SharePoint.
Practical 2026 Baseline
- Owners → Full Control
- Members → Edit (default, but controlled)
- Contributors (Custom) → Contribute
- Visitors → Read
With:
- Page editing controlled separately
- Custom groups used when needed
- Governance applied via approvals or policies
Common Pitfalls to Avoid
- Breaking inheritance excessively (creates complexity)
- Managing permissions separately from M365 Groups
- Relying on one-off manual fixes per site
- Overengineering permissions instead of targeting risk areas
Modern SharePoint design favors simplicity and consistency over granular control everywhere.
Final Thoughts
The original instinct to reduce Members from “Edit” to “Contribute” was correct— but the implementation approach has evolved.
In 2026, the better path is:
- Control where risk exists (Pages)
- Leverage Group-based identity
- Use supported customization paths
Instead of modifying the platform, modern SharePoint asks you to design within it.
Appendix: Legacy Workaround (Use with Caution)
Earlier implementations used a workaround to modify the built-in Members group permission level. This involved:
- Creating a placeholder SharePoint group
- Capturing the MembershipGroupId from the URL of the Members group
- Editing the placeholder group permissions
- Replacing the group ID in the URL to target the Members group
- Changing Members from Edit → Contribute
While effective, this method:
- Relies on URL manipulation
- Is not part of Microsoft’s supported administration model
- May break with platform updates
- Is not scalable or governance-friendly
Recommended Use Cases:
- One-off remediation
- Legacy environments
- Lab or troubleshooting scenarios
For modern deployments, prefer the supported approaches described above.