Today, I was working on a SharePoint 2016 environment and I noticed that my user with Contribute permissions were able to edit pages. Then when I searched for this issue I found quite a few people with the same issue. As far back as SharePoint 2010. Of course the work around of applying unique permissions to my pages libraries can work, but does that make this okay? I don’t think so.
As shown above the Add and Customize Pages is not ticked for the Contribute permission level. So why can users with this permission level update pages?
Is it because edit items is included in the Contribute permission level too?
Hi Pieter, as Pages are considered documents, that live in a library, they can be managed just like documents. So the “View, add, edit, delete items” permission set regulates that.
In older SharePoint versions the site’s homepage was generally a hidden page (site name/default.aspx) which could only be edited with the Full Control role. In any case in SharePoint Online all pages now live in a Pages library (site name/pages/default.aspx or site name/sitepages/default.aspx) and now they can all be edited.
In any case, this is how I explain this to site owners, who have been surprised that their site Members (with Contribute) can now edit the site’s Homepage.
Thanks for your comment Ellen. It looks like this is how it is working. But I still don’t like it. Contribute is very much contributing documents ( not pages). Editing pages is always seen as something for owners of sites. I’ve ended up running PnP-PowerShell to update all the permissions on all libraries on all sites within my SharePoint farm. I find this hard to sell especially as you can see in the screenshot in my post. Contribute doesn’t mean managing pages.