Owner Admin Reference Guide

ecgaustralia.com.au — Your complete reference for managing groups, members, sites, libraries and permissions

5

SharePoint Sites

16

AD Groups

35

Document Libraries

7

Staff Roles

1

Custom Permission

🔗

Quick Access — Admin Portals

Click to open in a new tab

Entra ID (Azure AD)

entra.microsoft.com

Add/remove group members

Microsoft 365 Admin

admin.microsoft.com

Users, licences, roles

SharePoint Admin

ecgaustralia-admin.sharepoint.com

Sites, libraries, permissions

Head Office Site

/sites/ECG-HeadOffice

Primary reference site

SharePoint Home

ecgaustralia.sharepoint.com

Browse all sites

My Account / My Groups

myaccount.microsoft.com

Manage your own groups

🗺️

Sites & Libraries — Complete Map

5 standalone sites · 7 libraries each · No Hub Site

Every SharePoint site is standalone — there is no Hub Site. Each site has the same 7 document libraries. The colour of each library chip shows which groups can access it. Hover over a chip to see the group names.

Library Name All-org groups access (Exec + OpsManager + HR or MKTG)

Library Name Branch role groups + OpsManager access

Library Name HR + OpsManager + BranchMgr access

Library Name MKTG + OpsManager + BranchMgr access

🏢 Head Office

ecgaustralia.sharepoint.com/sites/ECG-HeadOffice

ALL-ORG GROUPS ONLY — no branch groups

CLIENT FILES STAFF FILES COMPLIANCE DOCS MKTG FILES POLICIES AND FORMS TRAINING DOCUMENTS RECRUITMENT FILES

🌿 NT — Darwin

ecgaustralia.sharepoint.com/sites/ECG-NT-Darwin

All-org + NT-DAR branch groups

CLIENT FILES STAFF FILES COMPLIANCE DOCS MKTG FILES POLICIES AND FORMS TRAINING DOCUMENTS RECRUITMENT FILES

🌵 NT — Alice Springs

ecgaustralia.sharepoint.com/sites/ECG-NT-AliceSprings

All-org + NT-ALS branch groups

CLIENT FILES STAFF FILES COMPLIANCE DOCS MKTG FILES POLICIES AND FORMS TRAINING DOCUMENTS RECRUITMENT FILES

☀️ QLD — Ipswich

ecgaustralia.sharepoint.com/sites/ECG-QLD-Ipswich

All-org + QLD-IPS branch groups

CLIENT FILES STAFF FILES COMPLIANCE DOCS MKTG FILES POLICIES AND FORMS TRAINING DOCUMENTS RECRUITMENT FILES

🦘 QLD — Brisbane

ecgaustralia.sharepoint.com/sites/ECG-QLD-Brisbane

All-org + QLD-BNE branch groups

CLIENT FILES STAFF FILES COMPLIANCE DOCS MKTG FILES POLICIES AND FORMS TRAINING DOCUMENTS RECRUITMENT FILES

Key principle — access is group-driven You never change permissions on a library directly. To give or remove someone's access, add or remove them from the right AD group. The library permissions are fixed and permanent — only group memberships change.

👥

All 16 AD Groups — Who They Are & What They Can Access

4 all-org · 12 branch-specific

Every staff member's SharePoint access is determined entirely by which groups they belong to. Adding someone to a group immediately grants the access that group has. Removing them immediately revokes it.

All-Organisation Groups (apply to ALL 5 sites)

Group Name	Type	Who Belongs Here	Libraries They Can Access	Permission Level
`Executives`	M365	The 3 executive leaders (owners & members)	ALL libraries on ALL 5 sites	Full Control
`OpsManager`	Security	Operations Managers — all branches	ALL 7 libraries on ALL 5 sites	Contribute — No Delete
`HR`	Security	All HR staff across all branches	STAFF FILES · COMPLIANCE DOCS · POLICIES AND FORMS · TRAINING DOCUMENTS · RECRUITMENT FILES (all 5 sites)	Contribute — No Delete
`MKTG`	Security	All marketing staff across all branches	MKTG FILES only (all 5 sites)	Contribute — No Delete

Branch-Specific Groups (each group applies to ONE site only — Head Office has no branch groups)

Group Name	Branch	Who Belongs Here	Libraries Accessible on That Branch Site	Permission
`SupportCoord-NT-DAR`	Darwin	Support Coordinators at Darwin	CLIENT FILES only	No Delete
`SupportCoord-NT-ALS`	Alice Springs	Support Coordinators at Alice Springs	CLIENT FILES only	No Delete
`SupportCoord-QLD-IPS`	Ipswich	Support Coordinators at Ipswich	CLIENT FILES only	No Delete
`SupportCoord-QLD-BNE`	Brisbane	Support Coordinators at Brisbane	CLIENT FILES only	No Delete
`CareCoord-NT-DAR`	Darwin	Care Coordinators at Darwin	CLIENT FILES · POLICIES AND FORMS · TRAINING DOCUMENTS	No Delete
`CareCoord-NT-ALS`	Alice Springs	Care Coordinators at Alice Springs	CLIENT FILES · POLICIES AND FORMS · TRAINING DOCUMENTS	No Delete
`CareCoord-QLD-IPS`	Ipswich	Care Coordinators at Ipswich	CLIENT FILES · POLICIES AND FORMS · TRAINING DOCUMENTS	No Delete
`CareCoord-QLD-BNE`	Brisbane	Care Coordinators at Brisbane	CLIENT FILES · POLICIES AND FORMS · TRAINING DOCUMENTS	No Delete
`BranchMgr-NT-DAR`	Darwin	Branch Manager at Darwin	ALL 7 libraries on Darwin site only	No Delete
`BranchMgr-NT-ALS`	Alice Springs	Branch Manager at Alice Springs	ALL 7 libraries on Alice Springs site only	No Delete
`BranchMgr-QLD-IPS`	Ipswich	Branch Manager at Ipswich	ALL 7 libraries on Ipswich site only	No Delete
`BranchMgr-QLD-BNE`	Brisbane	Branch Manager at Brisbane	ALL 7 libraries on Brisbane site only	No Delete

Branch groups are site-scoped A Darwin Branch Manager (BranchMgr-NT-DAR) cannot see Alice Springs, Ipswich, Brisbane, or Head Office — even though they can see all 7 libraries on the Darwin site. Branch isolation is enforced at the library permission level, not at the user account level.

➕

How to Add (or Remove) Members from a Group

Via Entra ID — takes effect in minutes

This is the only admin task you need to do regularly The permission structure is fixed. All you manage day-to-day is group membership — who is in which group. Adding someone to a group gives them exactly the right access automatically. Removing them cuts off access immediately.

➕ Adding a Member to a Group

1

Open Entra ID

Go to entra.microsoft.com and sign in with your Executive / Admin account.

2

Find the group

Left sidebar → Groups → All groups → search for the group name (e.g. CareCoord-NT-DAR) → click to open it.

3

Open Members

In the group panel, click Members in the left sidebar of the group page.

4

Add the person

Click + Add members → search by name or email → tick their name → click Select.

5

Done — access is live within minutes

The staff member will be able to access the SharePoint libraries that group controls. No further action needed in SharePoint.

➖ Removing a Member from a Group

1

Open Entra ID

Go to entra.microsoft.com and sign in.

2

Find the group and open Members

Groups → All groups → search for the group → click Members.

3

Find the person and remove

Tick the checkbox next to their name → click Remove at the top of the list → confirm.

4

Done — access revoked immediately

They can no longer access the libraries that group controlled. If offboarding, remember to check all groups they belong to and remove from each one.

Offboarding reminder When a staff member leaves, remove them from ALL their groups in Entra ID AND disable their Microsoft 365 user account. Disabling the account blocks sign-in immediately.

📋 Which group should a new staff member go into?

Staff Member's Role	Their Branch	Add Them To This Group	What They Can Access
Executive / Director	All	`Executives`	Everything — all 5 sites, all 35 libraries, can delete
Operations Manager	All	`OpsManager`	All 7 libraries on all 5 sites, cannot delete
HR staff	All	`HR`	Staff Files, Compliance, Policies, Training, Recruitment on all 5 sites
Marketing staff	All	`MKTG`	MKTG Files only on all 5 sites
Branch Manager	Darwin	`BranchMgr-NT-DAR`	All 7 libraries on Darwin site only
Branch Manager	Alice Springs	`BranchMgr-NT-ALS`	All 7 libraries on Alice Springs site only
Branch Manager	Ipswich	`BranchMgr-QLD-IPS`	All 7 libraries on Ipswich site only
Branch Manager	Brisbane	`BranchMgr-QLD-BNE`	All 7 libraries on Brisbane site only
Care Coordinator	Darwin	`CareCoord-NT-DAR`	Client Files, Policies & Forms, Training Docs — Darwin only
Care Coordinator	Alice Springs	`CareCoord-NT-ALS`	Client Files, Policies & Forms, Training Docs — Alice Springs only
Care Coordinator	Ipswich	`CareCoord-QLD-IPS`	Client Files, Policies & Forms, Training Docs — Ipswich only
Care Coordinator	Brisbane	`CareCoord-QLD-BNE`	Client Files, Policies & Forms, Training Docs — Brisbane only
Support Coordinator	Darwin	`SupportCoord-NT-DAR`	Client Files only — Darwin only
Support Coordinator	Alice Springs	`SupportCoord-NT-ALS`	Client Files only — Alice Springs only
Support Coordinator	Ipswich	`SupportCoord-QLD-IPS`	Client Files only — Ipswich only
Support Coordinator	Brisbane	`SupportCoord-QLD-BNE`	Client Files only — Brisbane only

Staff in multiple roles? A person can be in more than one group. For example, a Branch Manager who also handles HR can be in both BranchMgr-NT-DAR and HR. Their access will be the union of both groups' permissions.

🔐

Permission Matrix — What Every Role Can Do

Branch site pattern (Head Office = all-org groups only, no branch groups)

✓✓ = Full Control — can view, upload, edit, delete, and manage permissions. Executives only.

✓ = Contribute — No Delete — can view, upload and edit. Cannot delete. All non-executive groups.

— = No access — library is invisible or Access Denied.

Library	Executives All 5 Sites	OpsManager All 5 Sites	HR All 5 Sites	MKTG All 5 Sites	BranchMgr Own branch only	CareCoord Own branch only	SupportCoord Own branch only
CLIENT FILES	✓✓	✓	—	—	✓	✓	✓
STAFF FILES	✓✓	✓	✓	—	✓	—	—
COMPLIANCE DOCS	✓✓	✓	✓	—	✓	—	—
MKTG FILES	✓✓	✓	—	✓	✓	—	—
POLICIES AND FORMS	✓✓	✓	✓	—	✓	✓	—
TRAINING DOCUMENTS	✓✓	✓	✓	—	✓	✓	—
RECRUITMENT FILES	✓✓	✓	✓	—	✓	—	—

Only Executives can delete files All non-executive groups use the custom "Contribute — No Delete" permission. If a staff member accidentally uploads a wrong file and needs it deleted, an Executive must log in and delete it. Staff cannot delete their own uploads.

Recovering a deleted file Executives can restore deleted files from the library's Recycle Bin. Open the library → click Recycle bin in the left sidebar → select the item → click Restore. Items remain in the Recycle Bin for 93 days.

📋

Common Tasks — Step by Step

Click each scenario to expand

🆕 Onboarding a new staff member ▼ expand

1

Create their Microsoft 365 user account — go to admin.microsoft.com → Users → Active users → + Add a user. Assign them a Business Premium licence.

2

Decide their role and branch — use the "Which group" table above to identify the correct group(s).

3

Add them to the correct group(s) in Entra ID — go to entra.microsoft.com → Groups → All groups → find the group → Members → + Add members → search their name → Select.

✓

Done — they can sign in and immediately access their SharePoint libraries. No further SharePoint configuration needed.

Example New Care Coordinator starting at Darwin → Add to CareCoord-NT-DAR. They will see the Darwin site and can access CLIENT FILES, POLICIES AND FORMS, and TRAINING DOCUMENTS automatically.

🚪 Offboarding a departing staff member ▼ expand

1

Block sign-in immediately — go to admin.microsoft.com → Users → Active users → click their name → Block sign-in → Yes. This prevents them accessing anything right away.

2

Remove from all groups in Entra ID — go to entra.microsoft.com → Users → All users → click their name → Groups tab. You will see every group they belong to. Remove them from each one.

3

Revoke active sessions — on their user page in Entra ID, click Revoke sessions to force sign-out of any active devices.

4

Reassign their licence (optional) — admin.microsoft.com → Users → Active users → click their name → Licences tab → remove the licence so it can be reused.

5

Delete or retain their account — Microsoft 365 retains deleted user data for 30 days. Only delete the account when you are certain you don't need it.

SharePoint access is revoked instantly once they are removed from all groups. They cannot access any files. You do not need to make any changes in SharePoint itself.

🔄 Transferring a staff member between branches ▼ expand

1

Go to Entra ID → Groups → All groups → find their OLD branch group (e.g. CareCoord-NT-DAR) → Members → tick their name → Remove.

2

Find their NEW branch group (e.g. CareCoord-QLD-BNE) → Members → + Add members → add them.

✓

Done — old branch access is revoked, new branch access is live. No SharePoint changes needed. Takes effect within minutes.

Example Care Coordinator moves from Darwin to Brisbane → Remove from CareCoord-NT-DAR, add to CareCoord-QLD-BNE. They can now see Brisbane's CLIENT FILES, POLICIES AND FORMS, TRAINING DOCS but can no longer see Darwin's site.

⬆️ Promoting a staff member to a more senior role ▼ expand

1

Remove from their old group — e.g. remove from SupportCoord-NT-DAR.

2

Add to their new group — e.g. add to CareCoord-NT-DAR or BranchMgr-NT-DAR depending on the promotion.

✓

Done — their access updates automatically to match the new role's library scope.

Temporary expanded access — if a Branch Manager is covering for another branch temporarily, you can add them to the second branch's group too and remove them when no longer needed. Being in multiple groups is fine.

🗑️ Deleting a file on behalf of a staff member (Executives only) ▼ expand

1

Sign in as an Executive and navigate to the specific site and library where the file needs to be deleted.

2

Locate the file → click the ⋯ (three dots) next to it → click Delete → confirm.

3

If you deleted it by mistake — go to the library → Recycle bin (left sidebar) → select the file → Restore. Files remain recoverable for 93 days.

Staff cannot delete files — this is by design. Only Executives have Full Control which includes the Delete permission. All other groups use "Contribute — No Delete".

🔍 Checking who is currently in a group ▼ expand

1

Go to entra.microsoft.com → Groups → All groups → search for the group name.

2

Click the group → left sidebar → Members. You will see a full list of all current members with their name and email address.

✓

You can export the member list using the Download button at the top of the Members list if needed for auditing.

📏

Rules & Things Not to Do

Keep these in mind to avoid breaking the permission structure

✅ DO

Add/remove people from AD groups in Entra ID to manage access
Put a person in multiple groups if their role spans departments or branches
Remove a staff member from all their groups when they leave — and disable their account
Ask an Executive to delete files on behalf of staff
Restore deleted files from the Recycle Bin within 93 days
Follow the naming pattern for any new groups you create (e.g. BranchMgr-SA-ADL for a new Adelaide branch)
Keep the Head Office site for all-org groups only — never add branch groups there

❌ DO NOT

Never change library permissions directly in SharePoint — always manage access via groups in Entra ID
Never add a branch group (e.g. BranchMgr-NT-DAR) to the wrong branch's libraries or to Head Office
Never register a site as a Hub Site — this build has no hub by design
Never restore default SharePoint groups (ECG — Darwin Members, ECG — Darwin Visitors) — these bypass the group-based permission structure
Never give a non-executive Full Control on any library — they would gain the ability to delete files
Never use the standard "Contribute" permission level — always use "Contribute — No Delete"
Never modify the custom permission level "Contribute — No Delete" — it was specifically configured to exclude deletion

How Everything Connects

The chain: Staff member → AD Group → Library Permission → Site access

1. A staff member is added to an AD group (e.g. CareCoord-NT-DAR) in Entra ID.

2. That AD group is granted "Contribute — No Delete" on specific document libraries on a specific SharePoint site (e.g. CLIENT FILES, POLICIES AND FORMS, and TRAINING DOCUMENTS on the Darwin site).

3. Because the group has access to at least one library on that site, the staff member can also navigate to and see that site — but they can only open the specific libraries their group has been granted access to. Other libraries appear as "Access Denied".

4. They can view, upload, and edit files in those libraries. They cannot delete anything.

5. Removing the staff member from the group in Entra ID immediately revokes all access — no changes needed in SharePoint.

Adding a Brand New Branch in Future

When you open a new branch (e.g. South Australia — Adelaide) You need to: (1) Create 3 new security groups in Entra ID following the same naming pattern: SupportCoord-SA-ADL, CareCoord-SA-ADL, BranchMgr-SA-ADL. (2) Create a new Team Site at /sites/ECG-SA-Adelaide. (3) Create the same 7 document libraries. (4) Break permission inheritance on all 7 libraries. (5) Create the "Contribute — No Delete" custom permission level on the new site. (6) Apply the same permission assignments as the other branch sites — substituting the new group names. (7) Add members to the new groups. No changes to any other sites or groups are needed.