Organise Folders and Control Access

What this covers

How to lay out your document library, and how to decide who can see what.

Plan: Business and above.

Building the folder structure

1. Go to Documents. The top level is All Documents.
2. Click New folder to create a folder at the level you're looking at. Click New subfolder to create one inside the folder you have open.
3. To add files, click Upload, or drag files from your computer onto the file area. "Drop files here to upload" appears while you drag.
4. To start a document from a standard layout, use Templates. They're grouped into General, HR, Finance and Operations.
5. To create a whole set of folders in one go, click From Template. See Folder Templates.

Right-click a folder, or use its ⋯ button, to see its menu: Open, Rename, Star, Move to…, Share…, Email a link…, Permissions…, Save as folder template and Move to trash. Administrators also see Activity. Moving a folder to the trash takes everything in it too.

The menu only shows what you're allowed to do. Rename and Move to… need Write access, Share… and Email a link… need Share access, and Permissions… appears only if you can manage the item's access (see below). If an action is missing, ask the folder's owner or an administrator.

Each file has a menu with Preview, Download / open in app, Rename, Star, Move to…, Share…, Email a link…, Permissions… and Move to trash, following the same rules. Administrators also see Version history and Activity. Documents that can be edited also have Edit here, which opens the file in the browser.

Moving things by dragging

You can drag files and folders instead of using Move to…:

• Onto a folder in the list. Drag a file or folder onto another folder in the file area. The folder is highlighted while you're over it.
• Onto the folder tree. Drag onto any folder in the tree on the left. Hold it over a closed folder for a moment and it opens, so you can go deeper.
• To the top level. Drop onto All Documents at the top of the tree.

A message at the bottom of the screen confirms the move, and the tree updates straight away.

You need Write access to what you're moving and to the folder you drop it into. A folder can't be dropped into itself or into one of its own subfolders. Dragging files from your computer still uploads them. It never moves anything.

Deleted items stay in Trash for 30 days and can be restored. See Version History, Trash and Quick Views.

Who can see what

A new library is open: anyone with access to the Documents module can use it. You lock things down folder by folder.

1. Right-click the folder and choose Permissions….
2. Search for people and security groups and tick everyone you want to add. You can pick several users, several groups, or both at once.
3. Tick what they can do: Read, Write, Delete or Share.
4. Click Add. Everyone you picked gets the same rights in one step. You can change each entry afterwards.

Who can change permissions: administrators, the person who created the item, and anyone with Share access to an item that's already restricted. Every change is recorded in the audit log.

Once a folder has any permission entry, it is restricted. Only the people and groups listed on it can use it. A few things to know:

• Permissions pass down. Access to a folder carries down to everything inside it, and what someone can do is everything they've been granted on the folder and the folders above it.
• Some people always have access. The person who created a folder, and your tenant administrators, keep access even if they aren't listed.
• The top level is separate. Setting permissions on All Documents controls the top level only. Folders that already have their own entries keep them.

Security groups

Groups save you adding people one by one. Administrators can create them with the Security Groups button.

• Link a group to an HR department. Its members then follow the department automatically: people join when they're added to the department and leave when they're removed.
• Or add members by hand, for groups that don't match a department.

Give folders to groups rather than to named people, and your access rules keep themselves up to date when staff join or leave.

For your IT team

• Access is additive and checked up the folder chain on every request. If no folder in the chain has an entry, the folder is open to the tenant.
• File previews and downloads go through the same access check as the file list. A restricted file can't be fetched by guessing its URL.

Where to go next

• Find Files: Columns, Filters and Sorting
• Document Audit Log
• Share Files Securely
• Version History, Trash and Quick Views
• How Documents Works
• Departments & Members — the departments that security groups can follow