SharePoint information architecture

Copying the old file server into SharePoint copies its problems too.

A good SharePoint structure means people find the right version first time, and you can explain who has access to what. It comes from planning sites around audience, ownership and lifespan, not from recreating a folder tree. Here is how to structure it, what changed in 2026, and a tool that tells you where a body of content belongs.

Based on Microsoft Learn guidance, checked 31 October 2026.

Review our SharePoint Find where it belongs 07 3114 2808

Sites, hubs and libraries
Permissions you can explain
Where-does-it-go tool

Reviewed by Blake Bath, General Manager, on 31 October 2026.

Blue, green and sand coloured box files grouped neatly on a timber shelf in a bright office — **The test**Can a new starter find the current version, and can you say who else can open it?

How it fits together

Four building blocks.

Each one has a job. Mixing them up is where things go wrong.

Sites

The access boundary. One per audience, owner or lifespan.

Flat
One owner
Own sharing

Where does it go?

Site, library or folder?

The same five questions we ask in every SharePoint design workshop.

Think of one body of content, like payroll, a client project or the policy library. Answer five questions and you get where it belongs and what to check first.

Who needs to see it?

Who owns and approves it?

How sensitive is it?

How long does it live?

Retention and records

Where it goes

A library or folder in the existing site

Same people, same owner and the same risk means no new boundary is needed.

Before you set it up

Use a few metadata columns and views for finding things, not deeper folders.

Review our SharePoint

Boundaries

When content needs its own site.

If the content has	Use	Why
A different audience	A new site	Sites are the access boundary
A different owner	A new site	Someone has to approve access and content
People outside the business	A separate site	Sharing is set per site
Confidential material for a few	A separate site or private channel	Not a folder with broken inheritance
Different retention rules	A separate library	Retention and default labels apply cleanly
Same people, same owner, same risk	A library or folder	No new boundary needed

Microsoft recommends flat sites joined by hubs rather than subsites. Subsites make restructuring harder later.

Access you can explain

Permissions that stay explainable.

Manage team sites through the groupFor Teams and group-connected sites, add and remove people in the group, not inside SharePoint.
Remember channel sitesStandard channels use the team's site. Private and shared channels each get their own site and membership.
Tighten sharing defaultsMicrosoft ships sharing at the most permissive setting. The more restrictive of tenant and site settings applies.
Record every exceptionEach shared link or broken inheritance is another access path. Note who, why and when it's reviewed.
Give every guest a sponsorA named person inside the business who says when their access should end.
Test as an ordinary userAdmins see everything. Check what a member and a guest can actually open.

Search and AI

Copilot finds everything people can already open.

Copilot and search respect permissions. They don't create new access. What they do is make old oversharing easy to find: the payroll folder shared with everyone in 2021, or a link set to anyone in the organisation.

Microsoft's preparation guide starts with the same work as good information architecture: owners on every site, inactive sites archived, sharing tightened and overshared sites found and fixed.

Find oversharingData access governance reports show broad links and sites open to everyone except external users.
Hide while you fixRestricted Content Discovery keeps a site out of Copilot and organisation-wide search without changing its permissions.
Archive what's deadOld sites add noise to answers and risk to every search.
Label what's sensitiveSensitivity labels on sites and files add a second layer of control.

Restricted Content Discovery is part of SharePoint Advanced Management, which comes with Microsoft 365 Copilot or as an add-on. Restricted SharePoint Search is retiring and can't be newly turned on from 31 July 2026.

What changed

What changed in SharePoint in 2026.

Change	When	What to do
SharePoint 2013 workflows retired	2 April 2026	Rebuild in Power Automate
SharePoint Alerts removed	From July 2026	Use Rules or Power Automate
Restricted SharePoint Search, no new enablement	From 31 July 2026	Use Restricted Content Discovery

Rules need Contribute permission on the list or library. Staff with read-only access who relied on Alerts need a Power Automate flow instead.

Numbers that matter

The limits worth knowing.

Limit	Number	What it means
Unique permissions per library	50,000 supported, 5,000 recommended	Keep exceptions few
Changing inheritance	Blocked above 100,000 items	Plan access before a library grows
Items synced per person	300,000 recommended	Across all synced libraries, shortcuts included
File path length	400 characters	Deep folders and long names break first
Lists and libraries per site	2,000	Rarely a problem for small business

Our view

Start with five real tasks, not the folder tree.

Ask five people to find something they use every week: the current leave policy, the latest drawing for a job, a signed contract. Where they look first tells you how they think. Build around that, then decide where the access boundaries need to be.

Then keep it simple: a site register with an owner and backup owner for each site, sharing tightened, exceptions written down, and a review twice a year. That is most of the value.

How we work

Our SharePoint review in five steps.

Step 1Inventory
Every site, team, channel, owner and sharing setting.
Step 2Tasks
How staff actually look for things.
Step 3Design
Sites, hubs, libraries and metadata.
Step 4Move
Content migrated, exceptions cleaned up.
Step 5Govern
Register, reviews and owners kept current.

Related guides

Structure first. Then everything else gets easier.

Guides that build on a sound SharePoint.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about SharePoint structure.

How many SharePoint sites should a small business have?

There's no right number. Create a site when content has a different audience, owner, sensitivity or lifespan, and join related sites with a hub. Most small businesses end up with an intranet site, a site per team or function, and project or client sites where those come and go.

Should we use folders or metadata?

Both. A shallow folder structure is fine where it helps people work. Metadata columns and views make finding and filtering easier. Neither one controls access.

Does joining a hub give everyone access to the sites in it?

No. A hub links navigation, branding and search. Each site keeps its own permissions, so test access on each one.

What replaced SharePoint Alerts?

Microsoft removed Alerts from July 2026. Use Rules in the list or library for simple notifications, or Power Automate. Rules need Contribute permission, so read-only staff need a flow instead.

Will Copilot show staff files they shouldn't see?

Copilot only shows what the person can already open. The risk is that many people can open far more than anyone intended. Check sharing and permissions before rolling it out.

Is there a file limit before sync breaks?

Microsoft recommends syncing no more than 300,000 items across all the libraries a person syncs, shortcuts included. It's a performance guide, not a hard stop. Sync what people need, not everything.

Next step

Want a SharePoint people can find things in?

We inventory what you have, design sites and permissions around how your team works, move the content and set up the register and reviews that keep it tidy.

Review our SharePoint 07 3114 2808