Private Drafts in SharePoint grant editors full control on the page which leads to permission problems

Do not rely on standard library content approval alone for separation of duties; configure a Power Automate page-approval flow with separate approvers, and use the site-level DisableSharingForNonOwners control to prevent authors from granting new access.

Microsoft’s documentation does not establish that creating a private draft is supposed to give a Contribute user unrestricted Full Control over the page. A private draft is documented as visible only to its creator and people with whom it is shared, while page sharing should respect site- and organization-level sharing settings.^1^ If Check Permissions reports Full Control on that page for a Contribute-only author, treat that specific elevation as a potential service issue rather than an approval design guarantee.

Enforce approval with a page-approval flow

For communication sites and modern team sites:

1. Open the site’s Pages/Site Pages library.
2. Select Automate > Power Automate > Configure page approval flow.
3. Select Create flow.
4. Specify an approver group that does not contain routine page authors.
5. Select Create.

After configuration, new and changed pages are not published directly; completing the approval flow makes them visible to site viewers.^2^

Also verify that Library Settings > Versioning settings > Document Version History uses Create major and minor (draft) versions, which is required for page approval.^3^

For strict “no self-approval,” customize the generated flow:

1. In the Pages library, select Automate > Power Automate > See your flows.
2. Open the page-approval flow and select Edit.
3. Add business logic that compares the page author/requestor with the selected approver.
4. If they match, route the request to a different approver, require an additional approval, or reject that approval route.

Microsoft supports modifying the generated page-approval flow with custom business logic, but only the SharePoint triggers and actions already used by a page-approval flow are supported on a Pages library.^4^

Standard library content approval does not itself enforce “an approver cannot approve their own item.” The relevant capability is the Approve Items permission, whose documented purpose is approving minor versions.^5^

Prevent authors from sharing pages with new users

If only owners should invite new users, a SharePoint Online administrator who is also a site collection administrator can apply the supported site-level switch:

Connect-SPOService -Url https://contoso-admin.sharepoint.com

Set-SPOSite `
  -Identity https://contoso.sharepoint.com/sites/publishing `
  -DisableSharingForNonOwners

DisableSharingForNonOwners prevents non-owners from inviting new users to the site.^6^ Test both a normal page and a newly created private draft afterward.

This controls invitations to new users. It should not be treated as a mechanism for removing access already granted or for changing who can collaborate when they already possess the necessary site access.

Verify whether Full Control is actually assigned

For one affected draft:

1. Open Site Pages and select the draft.
2. Open Manage access > Advanced.
3. Select Check Permissions and enter the author.
4. Record:
   • Whether the page has unique permissions.
   • The author’s effective permission levels.
   • Whether access comes from a direct assignment, sharing link, SharePoint group, Microsoft 365 group, or site-admin status.

Sharing an individual item can stop inheritance automatically. Full Control includes all SharePoint permissions, whereas Contribute grants item/document operations rather than all permissions.^5^

Do not routinely repair every private draft by manually resetting inheritance: that can remove the private-draft access scope and undermine the feature’s intended privacy. If a plain Contribute user consistently receives effective Full Control on newly created private drafts—even after non-owner sharing is disabled—open a Microsoft 365 support case with the affected site URL, page URL, creation time, effective-permissions result, and a comparison with a normally created page.

There is no documented per-site switch in the cited SharePoint controls to disable creation of private drafts or make them inherit the author’s ordinary permission level. The supported mitigation is therefore role-separated page approval plus the site-level non-owner sharing restriction, with escalation if effective permissions show unexplained Full Control.

References

1. [SharePoint in Microsoft 365](https://support.microsoft.com/sharepoint/pages-in-sharepoint/create-and-use-modern-pages-on-a-sharepoint-site)
2. Configure page approval using Power Automate | Microsoft Support
3. Approval flow for modern pages | Microsoft Support
4. Manage SharePoint page approvals with Power Automate
5. Permission levels in SharePoint
6. Set-SPOSite-Syntax