Private Drafts in SharePoint grant editors full control on the page which leads to permission problems

Saskia Picht 0 Reputation points
2026-10-30T08:34:11.8+00:00

I came across the problem that SharePoint pages that are created as private drafts give editors (even with just contribute permissions) full control on that page. Thus, this allows them to - with the standard content approval enabled - approve their own pages without any approver involved. This torpedizes the whole approval function, as anyone with the proper knowledge can go around it and publish content even in environments where processes are in place that demand this workflow.

Also - with Full Control on item level in place, the editor can share the information with anyone in the organization and give them edit rights, even if permissions should be strictly managed by the site owners (via "only site owners can share outside of the already set permissions"). This setting works fine with any normally created page, but private drafts, again, makes this non-functional.

Which is a pain, as there is no way to deactivate private drafts on individual sites.

Is this by design? Any idea how to work around this? It would be sufficient and better if a private draft granted the user the same permission he has (contribute or edit) instead of full control. That way the site settings would still apply to private drafts.

Is there any way around it?

Microsoft 365 and Office | SharePoint | For business | Windows
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Kristen Tran 2,785 Reputation points Independent Advisor
    2026-10-30T09:26:48.51+00:00

    Hi Saskia,

    Thank you for explaining the scenario in detail.

    Based on Microsoft’s documentation, private drafts are intentionally designed with a separate collaboration scope. A private draft is visible only to its creator, the people it has been shared with, and the site owner. Microsoft also specifically states that page authors can grant edit access to private drafts, including to collaborators who did not previously have access to the page or post.

    However, the documentation does not state that a user with Contribute permissions should receive unrestricted Full Control over the private draft. Therefore, I would distinguish the documented private-draft sharing behavior from the Full Control permission you are seeing.

    For sites where strict approval separation is required, there is an important configuration that may help. The private draft feature is not available when approvals are enabled for the Pages library and Draft Item Security is set to Only users who can approve items (and the author of the item).

    You can review this setting under:

    1. Open the Site Pages library.
    2. Select Settings > Library settings.
    3. Open Versioning settings.
    4. Review the approval and Draft Item Security configuration.
    5. Set Draft Item Security to Only users who can approve items (and the author of the item) if this configuration matches your intended approval model.

    Microsoft also notes that private drafts require the Pages library to use major and minor (draft) versions, so I recommend reviewing the existing versioning settings as part of the same check.

    For more information, please refer to Create a private SharePoint page or news post.

    If a Contribute-only user is still shown as having effective Full Control, I recommend asking your IT administrator to review the user’s effective permissions and determine where the additional access is coming from.

    If the permission cannot be accounted for through the site, library, group, or item-level configuration, please ask your IT administrator to open a support ticket with Microsoft Support through the Microsoft 365 admin center so the behavior can be investigated further. The steps are available in Get support in the Microsoft 365 admin center.

    In case you do not know who is your IT admin, kindly refer to this article: How do I find my Microsoft 365 admin? - Microsoft Support  

    I hope this helps clarify the distinction between the expected private-draft sharing behavior and the Full Control behavior you are seeing, while also providing a practical option for sites that require stricter separation between authors and approvers. Should you have any further questions, please feel free to let me know.

    Best regards.

    Was this answer helpful?

  2. AI answer

    2026-10-30T08:35:37.3333333+00:00

    Do not rely on standard library content approval alone for separation of duties; configure a Power Automate page-approval flow with separate approvers, and use the site-level DisableSharingForNonOwners control to prevent authors from granting new access.

    Microsoft’s documentation does not establish that creating a private draft is supposed to give a Contribute user unrestricted Full Control over the page. A private draft is documented as visible only to its creator and people with whom it is shared, while page sharing should respect site- and organization-level sharing settings.^1^ If Check Permissions reports Full Control on that page for a Contribute-only author, treat that specific elevation as a potential service issue rather than an approval design guarantee.

    Enforce approval with a page-approval flow

    For communication sites and modern team sites:

    1. Open the site’s Pages/Site Pages library.
    2. Select Automate > Power Automate > Configure page approval flow.
    3. Select Create flow.
    4. Specify an approver group that does not contain routine page authors.
    5. Select Create.

    After configuration, new and changed pages are not published directly; completing the approval flow makes them visible to site viewers.^2^

    Also verify that Library Settings > Versioning settings > Document Version History uses Create major and minor (draft) versions, which is required for page approval.^3^

    For strict “no self-approval,” customize the generated flow:

    1. In the Pages library, select Automate > Power Automate > See your flows.
    2. Open the page-approval flow and select Edit.
    3. Add business logic that compares the page author/requestor with the selected approver.
    4. If they match, route the request to a different approver, require an additional approval, or reject that approval route.

    Microsoft supports modifying the generated page-approval flow with custom business logic, but only the SharePoint triggers and actions already used by a page-approval flow are supported on a Pages library.^4^

    Standard library content approval does not itself enforce “an approver cannot approve their own item.” The relevant capability is the Approve Items permission, whose documented purpose is approving minor versions.^5^

    Prevent authors from sharing pages with new users

    If only owners should invite new users, a SharePoint Online administrator who is also a site collection administrator can apply the supported site-level switch:

    Connect-SPOService -Url https://contoso-admin.sharepoint.com

Set-SPOSite `
  -Identity https://contoso.sharepoint.com/sites/publishing `
  -DisableSharingForNonOwners

    DisableSharingForNonOwners prevents non-owners from inviting new users to the site.^6^ Test both a normal page and a newly created private draft afterward.

    This controls invitations to new users. It should not be treated as a mechanism for removing access already granted or for changing who can collaborate when they already possess the necessary site access.

    Verify whether Full Control is actually assigned

    For one affected draft:

    1. Open Site Pages and select the draft.
    2. Open Manage access > Advanced.
    3. Select Check Permissions and enter the author.
    4. Record:
      • Whether the page has unique permissions.
      • The author’s effective permission levels.
      • Whether access comes from a direct assignment, sharing link, SharePoint group, Microsoft 365 group, or site-admin status.

    Sharing an individual item can stop inheritance automatically. Full Control includes all SharePoint permissions, whereas Contribute grants item/document operations rather than all permissions.^5^

    Do not routinely repair every private draft by manually resetting inheritance: that can remove the private-draft access scope and undermine the feature’s intended privacy. If a plain Contribute user consistently receives effective Full Control on newly created private drafts—even after non-owner sharing is disabled—open a Microsoft 365 support case with the affected site URL, page URL, creation time, effective-permissions result, and a comparison with a normally created page.

    There is no documented per-site switch in the cited SharePoint controls to disable creation of private drafts or make them inherit the author’s ordinary permission level. The supported mitigation is therefore role-separated page approval plus the site-level non-owner sharing restriction, with escalation if effective permissions show unexplained Full Control.

    References

    1. [SharePoint in Microsoft 365](https://support.microsoft.com/sharepoint/pages-in-sharepoint/create-and-use-modern-pages-on-a-sharepoint-site)
    2. Configure page approval using Power Automate | Microsoft Support
    3. Approval flow for modern pages | Microsoft Support
    4. Manage SharePoint page approvals with Power Automate
    5. Permission levels in SharePoint
    6. Set-SPOSite-Syntax
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.