SharePoint Admin Security Lab

M365 Admin 2026
Governance Health: 68/100

Admin Interview Scenarios

Practice diagnosing real enterprise SharePoint data breaches and permission drifts:

Cert-to-SharePoint Bridge
Security+ CCNA Net+ Linux

Pro-tip for interviews: Relate SharePoint permission inheritance to Linux file DAC (POSIX permissions) and POSIX ACLs. Relate Hub Site boundaries to network VLANs and segmented routing.

Tenant Topology & Permission Structure

Root: contoso.sharepoint.com
Risk Findings: 4
Broken Inheritances: 2
Anonymous Links: 1
Hub Site: Corporate-Hub (Hub ID: hub-01)
📁 Finance-Team (Team Site) High Risk
Sharing: AnyoneLinksAllowed | Hub: Corporate-Hub
📄 Library: General-Documents Inherited
📂 Folder: Q4-Payroll (Restricted) Broken Inheritance
🔒 RnD-Vault (Secured Team Site) Critical Risk
Sharing: GuestSharingOnly | Label: Highly Confidential
📁 Library: Blueprints & Patents Anonymous Link Active
🌐 All-Company-Intranet (Communication Site) Low Risk
Sharing: InternalOnly | Everyone except external users: Read

Permissions & Policy Inspector

Finance-Payroll

Folder: Q4-Payroll

Parent Scope https://tenant.sharepoint.com/sites/Finance/Documents
Inheritance Unique (Broken)
Sharing Capability Anyone with link enabled
Sensitivity Label General Confidential (DLP Enforced)
Effective Access Control List (ACL) Direct vs Group
Finance Owners (Group)
Inherited from site collection
Full Control
Guest: vendor-alex@external.com
Direct ACL assignment (Drift)
Edit
Anonymous Token (Guest Link)
Anyone link expired in 14 days
Read & Download
Security Risk: Data Spill Exposure

The folder contains sensitive unmasked employee compensation data. Because permissions are broken and anonymous sharing is permitted on the parent site, external guests can exfiltrate documents without MFA.

CompTIA Sec+ Principle: Violation of Principle of Least Privilege & Uncontrolled External Trust Boundary.
One-Click Admin Remediation Action Required
PnP.PowerShell Execution Log PnP v2.4 (2026 Compatible)
PS C:\> # Initializing M365 SharePoint Governance Session PS C:\> Connect-PnPOnline -Url 'https://tenant.sharepoint.com/sites/Finance' -Interactive PS C:\> Get-PnPTenantSite -Detailed # Audited 3 sites: Found 2 broken permissions, 1 anonymous leak.
Top Interview Question: "What happens when you break inheritance?"
What they want to hear: When an admin or list owner clicks 'Stop Inheriting Permissions', SharePoint creates a copy of the parent ACL at that exact instant (turning inherited roles into explicit unique assignments). Over time, this creates permission drift: updates to parent Active Directory/Entra ID groups no longer replicate down to that folder. In interviews, emphasize running Reset-PnPListInheritance or setting strict Hub site governance policies so sites don't become unmanageable permission silos.
CCNA / Network Admin Analogy: Think of broken inheritance like setting a static IP or isolated Access Control List (ACL) on a specific switch port rather than allowing DHCP or standard 802.1X policy enforcement.
Interview Question: "How does Tenant Sharing tier overrule Site Sharing?"
The Hierarchy Rule: In SharePoint Online, permissions are strictly hierarchical. The Tenant External Sharing setting is the ceiling. If the M365 tenant-wide setting is 'Only people in your organization', no site administrator can create guest or anonymous links, even if the individual site's property says AnyoneLinksAllowed. Conversely, setting the Tenant to 'Anyone' delegates full vulnerability risk down to individual Site Collection Owners unless restricted by Conditional Access or Sensitivity Labels.
Security+ Concept: Defense-in-Depth and Centralized Policy Boundaries versus Decentralized Delegation.
Enjoy this tool? Build your own with Super