Who can see what
Security keeps fixing the same site.
Picture a site built around the org chart, with a library for each team. The people using it work on cases that cut across those teams, so to get a case in front of the right people they share a folder here and a file there. Inheritance breaks a little more each time. Security finds hundreds of unique permissions, raises a ticket and resets them. Six months later they’re back.
The site follows the org chart and the case work doesn’t. Until that work has a place of its own, with permissions set for the people who do it, each reset starts the clock again.
A move off SharePoint Server is the best chance to fix it, because the new sites don’t exist yet. Before anything moves, we map who shares work with whom on the old farm and draw the new sites around those groups.
In NovalysisIn SharePoint Online, Novalysis works through each site’s permissions down to the item and inventories its sharing links. Where the files in a folder keep being shared with the same few people, it treats them as a working group. Then it suggests where that work belongs: a private team in Microsoft Teams, a restricted library, or a space shared with the department they work with.