SharePoint for a small business: what it is, what you get, and the settings to decide once

Microsoft describes SharePoint as a tool for creating web sites, publishing content and storing files. A SharePoint site holds pages and document libraries, the libraries being where its files are kept. Two kinds of site matter to a small business:

Each licensed user also gets a OneDrive of their own, kept apart from SharePoint's storage. Teams uses both, and where a file ends up depends on where it was shared:

SharePoint comes with Microsoft 365 Business Basic, Business Standard and Business Premium: Microsoft's plan table lists SharePoint Plan 1 on all three, and its SharePoint limits page lists it as included in them. Each user in the organisation needs a licence that includes SharePoint to use it. On Microsoft's Irish page in October 2026, Business Basic was €6.07 a user a month, paid yearly, before VAT, or €4.67 in the version without Teams; the plans compared with Google Workspace has the rest.

The storage is one allowance for the whole tenant: 1 TB, plus 10 GB for each licence bought, not counting each user's OneDrive. Microsoft's own example is a tenant with 100 users, which has 2 TB; ten licences give 1 TB plus 100 GB. A single site can hold up to 25 TB, and more storage can be bought in steps of 1 GB.

The recycle bins count against the same allowance. A tenant that keeps running over its limit is at risk of being put into read-only mode, where people may not be able to add or change files until storage is freed or bought.

External sharing is on by default across SharePoint and OneDrive, and Microsoft suggests turning it off before people start using sites if you don't yet know how you want to use it.

Sharing is set at two levels. The organisation-level setting, in the SharePoint admin center under Policies, then Sharing, is the most any site can allow. Each site can be set the same or tighter, and where the two differ the tighter one applies. Changing a site's setting needs a SharePoint Administrator; site owners can't.

Each new site starts from a default that depends on its type, as Microsoft lists them:

Microsoft's own advice for confidential information is to keep it in a site with external sharing turned off, and to create separate sites for working with people outside the business. Where Anyone links stay allowed, its planning guide suggests making Specific people or People in your organisation the link shown by default, so that anybody sharing has to choose Anyone on purpose, and restricting Anyone links to view only or setting them to expire.

The settings to decide, in Policies, then Sharing:

In a team site, permissions follow its Microsoft 365 group: group owners become site owners and group members become site members. Where the site belongs to a team, Microsoft recommends managing all of its permissions through Teams. Microsoft 365 groups have no view-only level, so anyone who should only read the site is added to its Visitors group.

Permissions can be set on a site directly, with SharePoint groups, apart from its Microsoft 365 group, and Microsoft recommends against it for the simplest management. In the site of a private or shared channel, permissions come from the channel and can't be changed in SharePoint.

Access to a site gives a person all of its content; a single file or folder is shared with a link. Files and folders can also be given permissions of their own, within limits: Microsoft supports 50,000 unique permissions in a list or library and recommends 5,000 as a general limit, and a library or folder with more than 100,000 items can't have its permissions separated from its parent. Microsoft's limits page also recommends creating separate sites, organised into hubs, in place of subsites.

Permissions matter more once Copilot is in use, and Business Standard and Premium are now sold with it: Microsoft says Copilot only surfaces organisational data that the person has at least view permission to. What to check before switching Copilot on.

SharePoint keeps earlier versions of each file. Microsoft's default for a new library is 500 major versions, with no time limit, and an administrator can switch the organisation to an automatic setting, which Microsoft recommends for version storage. A change at organisation level applies to libraries created after it, not to existing ones, and versions removed because a library went over its limit are deleted permanently, bypassing the recycle bin.

Deleted files go to the site's recycle bin. Deleted from there, or when the bin is emptied, they go to a second-stage recycle bin, which site collection administrators can see and restore from. Microsoft's retention documentation gives 93 days across both stages before a deleted document is permanently deleted.

A retention policy keeps a copy of each file for a set period even after someone edits or deletes it, in a hidden Preservation Hold library. Microsoft's licensing guidance lists Business Premium among the plans that give the right to use one, and, for SharePoint and OneDrive, SharePoint Plan 2. Business Basic and Standard are not on that list.

Versions, recycle bins and retention all sit inside the same tenant as the files themselves. What counts as a backup, and how to test a restore covers a copy kept apart.