Key takeaways
Build SharePoint around how work happens: one communication site for company information, a team site for each department or client group, and a hub only if you need shared navigation.
Grant access through Microsoft 365 group membership at the site level, and avoid giving individual files their own permissions.
Decide early who can create sites and Teams, give every site at least two owners, and review owners when people leave.
The simplest way to organize SharePoint for a small business is to plan sites around how work actually happens: one communication site for company-wide information, a team site for each department or client group, and access granted by group membership rather than file by file. Keep folders shallow, name things consistently, and decide early who is allowed to create new sites and Teams. That structure is easy to explain, easy to secure and easy to keep tidy.
Why structure matters
SharePoint rarely fails because of the technology. It fails because it grows without a plan: a site for every project, permissions set on individual folders, and nobody sure which copy of a document is current. Staff stop trusting it and go back to email attachments and personal drives. A little planning up front avoids that, and it makes security far easier because you can see who has access to what.
Plan sites around how work happens
Microsoft describes three building blocks, and each has a clear job:
Communication site
For broadcasting. A small number of people publish and everyone else reads. Good for the company intranet home page, HR policies, forms and announcements.
Team site
For collaborating. Members create and edit content together. Team sites are connected to a Microsoft 365 group by default, which also gives the group Teams, a shared mailbox and Planner.
Hub site
For connecting. A hub ties related sites together with shared navigation, branding and news. Associating a site with a hub does not change that site's permissions.
Microsoft's guidance is to give each unit of work its own site rather than nesting subsites, because separate sites are easier to reorganize, secure and govern as the business changes. For most firms under 30 people, a hub is optional; one communication site as the front door with links to team sites is often enough.
Libraries, folders and metadata: keep it simple
Inside a site, files live in document libraries. A few practical rules:
• Use a separate library when content needs different permissions or a different purpose, such as Clients versus Templates.
• Use folders for familiar grouping, like one folder per client or per year, but keep them to two or three levels deep.
• Metadata, meaning extra columns such as Client, Matter Type or Status, makes filtering and search better. It is optional; add one or two columns only if people will actually fill them in.
• Do not recreate the old file server's 12-level folder tree. Long paths are hard to navigate and can cause sync problems.
Naming conventions
Agree on names before you create anything. Short, plain, consistent names make sites easy to find and their web addresses readable.
• Sites and Teams: department or function first, for example HR, Finance, Projects-Commercial, Clients-Tax.
• Client or project folders: a consistent pattern, such as ClientName-Year or ProjectNumber-ProjectName.
• Files: a date format that sorts correctly, such as 2026-10-08, rather than spelled-out dates.
• Avoid personal names in site names. People leave; functions remain.
Permissions: use group membership, not individual files
On a group-connected team site, permissions flow from the Microsoft 365 group. Group owners become site owners and site administrators, and group members become site members. Adding someone to the team or group gives them the right access to the site, and removing them takes it away. That is the model to rely on.
Every file and folder inherits its permissions from the library or folder that contains it. When you give one item its own permissions, called breaking inheritance, it becomes a separately secured object. Microsoft allows up to 50,000 of these per library but recommends staying under 5,000 for performance, and recommends minimizing them by relying on inheritance and groups.
Common permission mistakes
Breaking inheritance everywhere
Unique permissions on dozens of folders and files make it nearly impossible to answer who can see what. If a set of files needs different access, give it its own library or site instead.
Sharing with Everyone except external users
This built-in group includes every account in your organization. On a public group-connected team site it gets edit access by default. Make team sites private unless everyone truly should edit them, and avoid granting this group access to sensitive libraries.
Owners who have left
When a site's only owner leaves, nobody can manage membership or settings. We suggest at least two owners for every site and team, and checking ownership as part of offboarding.
Sharing links nobody tracks
Ad hoc links to people outside the firm pile up. Review sharing settings and decide what level of external sharing each site allows.
A step-by-step plan for a 10 to 30 person firm
Take a hypothetical 22-person property management firm with accounting, operations and leasing staff, moving from a file server to SharePoint.
1. List how work is actually divided: departments, client groups or practice areas, and who needs to see what.
2. Create one communication site as the company home page for policies, forms, announcements and links.
3. Create one private team site, with a matching team in Teams, for each department or client group, such as Accounting, Operations and Leasing.
4. Within each team site, create a small number of libraries by purpose, such as Clients, Templates and Internal, and agree on a shallow folder pattern.
5. Assign access by adding people to each team or group. Name at least two owners per site.
6. Identify the few genuinely restricted items, such as payroll or HR files, and place them in their own site or library rather than locking individual folders.
7. Clean up the old file server before migrating: archive what is stale and move only what people use.
8. Write a one-page guide covering where things go, naming rules and who to ask for a new site, then walk staff through it.
Governance basics: who can create sites and Teams
By default, any user can create communication sites and group-connected team sites, and any user can create Microsoft 365 groups, which includes creating a team in Teams. Microsoft recommends leaving group creation open in many organizations so people can collaborate without waiting on IT, but small firms often prefer a light gate to prevent sprawl.
• Site creation can be turned off for users in the SharePoint admin center. That setting does not stop people from creating Microsoft 365 groups or Teams, which create their own sites.
• Group and Teams creation can be limited to members of a chosen group. According to Microsoft, the admin who configures this and the people allowed to create groups need Microsoft Entra ID P1 or P2, which Business Premium includes.
• Whatever you decide, write it down and make requesting a new site easy, or people will work around the rule.
• Review sites and owners once a year and archive what is no longer used.
How NexJen can help
Our SharePoint Online consulting engagement is a fixed-scope, advisory review. We take a read-only look at your current sites, libraries, sharing and permissions, then deliver written, risk-rated findings, a recommended structure and governance approach, and a readout call. We do not change your tenant under consulting. If you want help building the structure or migrating from a file server, we quote that separately as a fixed-fee project or fold it into our NexJen Essentials managed plan.
Common questions
Should a small firm use one SharePoint site or many?
Usually several: one communication site for company information and one team site per department or client group. One giant site with folder-level permissions is harder to secure and maintain.
Do we need a hub site?
Not always. Hubs help when you have enough sites that shared navigation and news roll-up are useful. Many firms under 30 people do fine with a home communication site linking to team sites.
Is it bad to set permissions on individual folders?
Occasionally it is fine. As a habit, it creates a permissions maze. Move content that needs different access into its own library or site instead.
Want a SharePoint structure that stays tidy?
Our SharePoint Online consulting engagement reviews your sites and permissions and delivers a written structure and roadmap for your firm.