A shared pricing, quoting or costing workbook can create a simple but important question: everyone may need to see the figures, but who should be allowed to change them?
That distinction matters when a workbook contains supplier costs, margins, labour rates or approved assumptions. A user may need to enter quantities or prepare a quote without being able to overwrite the rate table behind it. Excel, OneDrive and SharePoint can provide useful controls, but they operate at different levels. Understanding those levels helps you decide whether the workbook can remain a controlled shared file or has become an operational workflow that needs a different structure.
Excel permissions are not one setting
Permissions for a shared workbook usually sit across four layers:
- Storage access controls who can open the file.
- File sharing controls whether a person can view or edit it.
- Workbook protection controls structural changes, such as adding or moving worksheets.
- Worksheet protection controls which cells users can change.
These layers work together, but none automatically creates a full business permission model. Giving someone edit access to a workbook is not the same as allowing them to submit a rate change while preventing them from publishing it.
File access: Excel, OneDrive and SharePoint
A locally stored workbook is difficult to govern. Copies can be emailed, saved to personal folders or changed without the team knowing which version is current. For collaborative editing, the master workbook should normally be stored in OneDrive or SharePoint and opened with supported Microsoft 365 applications.
Microsoft's modern co-authoring approach allows people to work in the same workbook when it is stored in a supported cloud location. This is generally preferable to the older Shared Workbook feature, which Microsoft describes as having significant limitations. See Microsoft's overview of Shared Workbooks and co-authoring.
OneDrive
OneDrive can suit a workbook owned by one person or a small team. The owner can share the file with named people and choose whether they can view or edit it. This can be appropriate where access is simple and ownership is clear.
As folders, exceptions and staff changes accumulate, however, an individual file-sharing arrangement can become harder to review consistently.
SharePoint
SharePoint is often a better home for a departmental workbook because permissions can be administered through sites, libraries and groups. A document library commonly inherits permissions from its parent site, and files in that library commonly inherit those permissions in turn.
This inheritance needs careful handling. While inherited access remains in place, permissions are cumulative: a user who receives edit access through a site or library group can still edit even if someone also shares a document with them as view-only.
A lower-level read-only share does not reliably remove an existing higher-level edit route. To create a genuinely narrower boundary, an authorised SharePoint administrator can configure unique permissions for a library, folder or document by breaking inheritance and then removing or changing the inherited groups or permissions that grant the unwanted access. That approach should be used deliberately, because it creates another permission boundary to maintain.
Before relying on a document as read-only, check every route through which the user receives access, including site groups, library membership, folder permissions and direct sharing.
What Excel protection can and cannot do
Excel protection is useful when you need to reduce accidental changes inside a workbook.
Workbook structure protection
Workbook structure protection can prevent users from adding, deleting, renaming, moving, hiding or unhiding worksheets. It helps keep a model intact, but it does not decide which colleague may alter a particular cost, rate or record.
Worksheet and cell protection
A protected worksheet can keep formulas, reference tables and sensitive cells locked while leaving selected input cells available for editing. This is often useful for a controlled calculator, quote form or operational register.
Microsoft also documents editable ranges for particular users in supported Windows domain environments. See Microsoft's guidance on locking or unlocking worksheet areas.
The limitation is that a protected range is still a spreadsheet control, not a workflow step. It can help answer, “Which cells may this person edit?” It does not naturally answer, “Who may propose a supplier-rate change, who approves it, and when does the approved rate become live?”
A practical setup for multiple users
Start with the business roles, not the Share button. Write down who needs to view the workbook, enter operational data, change master data and approve changes.
| Role | Typical requirement | Appropriate control |
|---|---|---|
| Viewer | Read approved costs, rates or reports | View access in OneDrive or SharePoint |
| Operational user | Enter quantities, job details or other controlled inputs | Edit access where required, with protected worksheets and limited editable cells |
| Rate owner | Maintain approved rates or reference data | Named edit access and clearly defined editable areas |
| Approver | Review a proposed change before it is used | A documented process, or an application workflow where approval must be enforced |
Use the following sequence when configuring a shared workbook:
- Keep one controlled master file. Store it in OneDrive or SharePoint rather than relying on emailed attachments or local copies.
- Assign named access. Give view access to people who only need to read the data. Give edit access only where someone needs to change workbook content.
- Check inherited SharePoint access. Review the site, library, folder and document permissions before assuming a user is restricted to view-only access.
- Protect workbook structure where appropriate. Prevent structural changes if users should not add, move or rename tabs.
- Protect sensitive worksheets. Lock formulas, reference data and sensitive rates, leaving only the cells needed for the intended task available.
- Test with representative users. Test as a viewer, an operational editor and a rate owner. Confirm what each person can open, edit and save.
- Review access after role changes. Remove or amend access when responsibilities change, temporary cover ends or a colleague leaves.
Microsoft provides guidance on co-authoring Excel workbooks and protecting worksheets.
Common permission problems
| Symptom | Likely cause | Practical response |
|---|---|---|
| A user can change a sensitive rate | The sheet is not protected, or the rate cells are unlocked | Protect the worksheet and lock sensitive cells, leaving only necessary inputs available |
| A view-only user can still edit | They receive edit access through a SharePoint site, library, folder or group | Check effective access and remove or change the edit route, or configure properly maintained unique permissions where needed |
| Changes do not appear for colleagues | Users are working from copies or the master file is stored locally | Establish one cloud-based master workbook and direct users to that file |
| Users receive locked-file or collaboration issues | A client, file format or workbook feature is incompatible with co-authoring | Check the supported client and workbook setup, then test the real access route used by the team |
| A legitimate user is blocked from entering data | Required cells remain locked or worksheet settings do not allow the intended action | Test the task using an account with that user's permissions and adjust only the required area |
| Nobody knows who changed a value | Shared accounts or informal access are being used | Use identifiable individual accounts and review access regularly |
A useful check is to ask each user: “Show me the values you are expected to change, and show me the values you are not allowed to change.” If that answer differs from the process owner's expectation, the configuration is not yet ready.
When SharePoint permissions are enough
Excel with OneDrive or SharePoint can be a reasonable fit when the workbook remains primarily an analytical or planning tool. It is particularly useful where:
- a small, known group needs to collaborate;
- users mainly need broad view or edit access;
- worksheet protection is sufficient to prevent accidental changes;
- the workbook is used for modelling, forecasting or scenario analysis; and
- the business can manage access, exceptions and protection settings internally.
Excel remains valuable for flexible calculations and exploratory work. The aim is not to remove it from processes where it continues to be the right tool.
When the workbook has become an operational application
A spreadsheet becomes harder to govern when permissions need to follow the process rather than the file. Warning signs include:
- sales staff may use approved costs but must not amend source rates;
- a buyer may propose a change but cannot make it live;
- a manager needs to approve an exception;
- users should see only the jobs, customers or records relevant to their role;
- the team needs controlled handoffs rather than a shared grid; or
- maintaining SharePoint permissions, protected ranges and exceptions has become ongoing operational work.
At this point, more workbook protection may not solve the underlying issue. The requirement is no longer simply to share a file safely. It is to run a repeatable process with controlled actions, validated inputs and clear responsibilities.
A managed custom web application can provide individual logins, task-specific screens and permissions designed around the workflow. Instead of giving someone access to a workbook and asking them to avoid certain cells, the application can present the actions relevant to their role.
| Requirement | Configured Excel | Managed web application |
|---|---|---|
| Flexible analysis and scenario modelling | Strong fit | May be unnecessary |
| Prevent accidental edits to selected cells | Possible with worksheet protection | Possible through task-specific screens |
| Separate proposal, review and approval stages | Relies on process discipline and supporting controls | Can be designed as explicit workflow steps |
| Different access by role or record | Can become difficult to maintain | Can be designed into the access model |
| Ongoing permission administration | Managed internally through file and platform settings | Managed as part of the application service |
If a workbook has become business-critical, replacing Excel with a managed application can be a more suitable route than adding further sharing exceptions. The important question is whether the business needs a shared model or a controlled operational process.
Next step
Review where the master workbook is stored, map every user's required level of access and test the configuration using real roles. If the workbook now governs recurring quoting, rate maintenance, approvals, inspections or other operational work, it may be worth assessing whether a managed application would provide a clearer and more maintainable permission model.