Share via

Maintaining File and Folder Permissions During a SharePoint Site-to-Site Migration

Stephanie Bunker 0 Reputation points
2026-05-31T03:51:58.0666667+00:00

We need to reorganize content by moving it to a different SharePoint site within the same tenant. The challenge is ensuring that all existing access rights, including guest-user permissions, continue to work after the move. What approach would you recommend?

Microsoft 365 and Office | SharePoint | Development
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-05-31T03:52:14.5566667+00:00

    Use a migration approach that explicitly migrates permissions and relies on identity mapping, rather than manually copying content.

    Recommended approach:

    1. Plan identity and guest access
      • Ensure all internal users and guest users that currently have access exist and are correctly mapped in the destination site.
      • For cross-tenant or B2B guests, provision them in Microsoft Entra ID first so they can be used in permissions and “Shared with” references.
      • When using migration APIs or tools, complete identity mapping before any migration so that principals (users/groups/guests) resolve correctly.
    2. Use a migration tool that preserves permissions
      • For site-to-site moves, use SharePoint migration capabilities (Migration Manager/SPMT or Migration API–based tools) rather than manual download/upload.
      • Configure the project to migrate permissions:
        • Folder permissions: by default, folder permissions are migrated and files inherit from folders.
        • File permissions: if you need item-level permissions preserved, enable file-permission migration in project settings so destination files keep the same ACLs and sharing as the source.
      • Be aware that migrating file permissions can slow down the migration, but it is required if fine-grained access must be preserved.
    3. Understand how permissions are translated
      • When migrating from file-share–like sources, NTFS permissions are mapped to SharePoint roles (Full control → Full control, Modify/Write → Contribute, Read → Read, etc.).
      • For cloud sources (Box, Google Drive, Dropbox, Egnyte), roles are mapped to SharePoint/OneDrive roles such as Owner, Can edit, Can view.
      • Advanced NTFS permissions and explicit deny entries are removed; the most restrictive effective permission is used. Plan for possible changes in edge cases where deny was used.
    4. Preserve sharing and “Shared with me” behavior
      • The per-user sharing model depends on both:
        • The actual permission (ACL/role assignment), and
        • The “Shared With” references.
      • During migration, ensure both are imported:
        • Use migration APIs (e.g., PRIME/Import API) or tools that can import SPFile/SPFolder and SPListItem with “Shared With” data and then apply security scopes and role assignments.
      • This is especially important for guest users so that their “Shared with me” view continues to surface migrated content.
    5. Handle checked-out files and active use
      • Permission updates will not apply to files that are checked out. Before migration, check in or discard checkout for items that must have permissions updated.
      • If the source site is actively used during migration, existing permissions on the site and documents are enforced. Schedule a freeze window or use delta sync to avoid conflicts.
    6. Use delta sync to keep permissions aligned
      • After the initial migration, use delta sync (incremental migration) to pick up changes. Permissions are updated when corresponding files are transferred in delta runs.
      • This helps keep the destination site aligned with the source until cutover.
    7. Special considerations for cross-tenant or geo moves (if applicable)
      • For cross-tenant SharePoint migrations, use the built-in cross-tenant migration feature:
        • Precreate users and groups and prepare identity mapping so users (including guests) retain access.
        • After migration, users with permissions continue to have access if they were included in identity mapping.
      • Be aware that workflows, apps, Power Apps/Power Automate, and some sensitivity label behaviors do not automatically migrate and may need to be recreated.
    8. Post-migration validation
      • After cutover, validate:
        • Key folders and files have the expected unique/inherited permissions.
        • Guest users can still access content and see items in “Shared with me” where applicable.
        • No critical content became broadly accessible due to removal of advanced/deny permissions.

    This approach—identity mapping first, then using a migration tool/API configured to migrate both permissions and sharing metadata, with delta sync and validation—provides the best chance of preserving all existing access rights, including guest-user permissions, when moving content between SharePoint sites.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

    1 person found this answer helpful.
  2. Teddie-D 17,140 Reputation points Microsoft External Staff Moderator
    2026-05-31T05:12:38.44+00:00

    Hi Stephanie Bunker

    When moving content between SharePoint sites in the same tenant, it is important to plan ahead because permissions and sharing links may not carry over exactly as they are. 

    Recommended approach: 

    1.First, please check how access is currently configured. Confirm who has rights as site Owners, Members, and Visitors. Review the SharePoint groups in use, identify any files or folders with unique permissions, and note whether guest users have been granted access. 

    2.Set up the target site with the groups and permissions that will be required. If guest access is needed, confirm that external sharing is enabled on the destination site. 

    3.Use the Move to or Copy to options in SharePoint Online. Keep in mind that content moved in this way often inherits permissions from the destination site, and item-level permissions may not be preserved

    Reference: Move files and folders between OneDrive and SharePoint - Microsoft Support 

    4.Test access for both internal and guest users. Recreate sharing links if necessary. If possible, begin with a small pilot move to confirm that everything behaves as expected before migrating all content.  

    If preserving permissions exactly is critical, especially when there are many unique permissions or guest sharing scenarios, organizations often rely on third-party migration tools to provide more control over permission mapping and validation.  

    You may see AI-generated guidance suggesting the use of SPMT in this scenario. While SPMT is a valuable tool, it is primarily intended for migrations from file shares or on-premises environments into SharePoint Online. It is not typically intended for reorganizing content between SharePoint sites within the same tenant and does not guarantee full preservation of permissions or sharing links in this scenario.

    I hope this information is helpful.  

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".     

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.   

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.