SharePoint Security Trimming Quicklinks

Using the web part (site owners and editors)

Quick and easy to get started: add the web part, choose how links are supplied, pick a layout, then publish. Links to SharePoint content are automatically hidden from users who do not have access.

1) Add the web part to your page

1. Click Edit on your SharePoint page.
2. Click the + control where you want the web part (between sections or in a column).
3. Search for and select ISS — Security Trimming Quicklinks (toolbox name may match your catalog entry). The description notes that quicklinks are shown with security trimming based on user permissions.

2) Add your links (choose one option)

Open the web part properties and pick a Data source:

1. Visual link editor — Choose Curated links — Visual editor, then click Manage links to add, reorder, or remove links; set icons or images and open-in-new-tab per link. Use Add All missing Lists and Libraries to append site libraries and lists not already in your list.
2. JSON editor (advanced) — Choose Advanced — Custom JSON and edit the link array (title, url, openInNewTab, and optional description, iconName, imageUrl). Fix invalid JSON before saving or using merge helpers.
3. Automatic links — Choose Auto from this site — Libraries & lists, set Content to display (libraries only, lists only, or both), and list excluded library or list display names (one per line). Default exclusions apply when the exclusion fields are empty on first use of this mode.

Click to enlarge

3) Select your layout type

In the property pane, open Layout type and choose the style that fits your page:

• List — Vertical list with icons and descriptions.
• Compact — Tight grid with small icons.
• Grid — Cards with centered content.
• Tiles — Large image tiles with labels (optional hide labels on hover).
• Button — Horizontal buttons.
• Filmstrip — Horizontal scrolling cards.

Also set columns (for grid-style layouts), show or hide icons/images and descriptions, image/icon size, and optional caching (see below).

Click to enlarge

Caching

Optional browser caching stores permission results for faster repeat visits. Higher cache duration means permission or link changes may take longer to appear for viewers. Turning caching off forces fresh checks. Cache is scoped per user and web part instance; changing the data source or relevant settings clears the cache for that configuration.

What end users see

• Loading — Short “Loading links…” while permissions resolve.
• Licensed or trial — Links and optional title; no NOT LICENSED banner (see licensing states).
• Not licensed — Full functionality with a prominent NOT LICENSED banner (Tenant ID and support details may be shown). Request a trial or purchase via licensing states.
• No links configured — “There are no links to show yet.” Editors in edit mode see a hint to open properties.
• Everything trimmed — “Nothing here matches your access right now.”
• Error — For example invalid JSON in the advanced source.

How security trimming works

The web part implements true security trimming for Security Trimming Quicklinks in SharePoint Online: for each in-tenant SharePoint destination, it checks whether the signed-in user has at least Read access before displaying the link.

Which links are evaluated

Trimming applies to SharePoint URLs in your tenant that the web part can resolve—sites, document libraries and their files, site pages, folders, and lists (including custom lists)—including cross-site links on your organization's SharePoint hosts. Public sites, mailto:, tel:, and destinations in another tenant are not validated the same way; editors can still add them as curated navigation when that fits your page.

Example shapes (substitute your tenant hostname): a site root such as https://your-tenant.sharepoint.com/sites/YourSite, library or folder paths ending in / or a file name, and list URLs under /Lists/….

What happens for each link

• The web part resolves the destination in your tenant (file, folder, library, list, or site as appropriate).
• It evaluates whether the current user has sufficient access to open that destination.
• The link is shown only when Read-level access is confirmed; otherwise it is hidden for SharePoint targets.

Security model

• Fail-closed: if a check fails or the outcome is unclear for a SharePoint target, the link is hidden.
• Read required: links are shown only when the user has at least Read on the resolved resource.
• Cross-site: works across sites within the same tenant where the web part can resolve the target.
• Errors: errors during evaluation result in hiding the link for SharePoint targets.

Examples (JSON link entries)

With access, the link appears; without Read on that target, it is hidden.

{
  "title": "Shared Documents",
  "url": "https://your-tenant.sharepoint.com/sites/SiteName/Shared Documents/"
}

{
  "title": "Budget Report",
  "url": "https://your-tenant.sharepoint.com/sites/SiteName/Shared Documents/report.pdf"
}

{
  "title": "Project Tasks",
  "url": "https://your-tenant.sharepoint.com/sites/SiteName/Lists/ProjectTasks/"
}

Troubleshooting and performance

Link not showing (but the user has access)

1. Confirm the link opens for that user when they browse to the same address directly in SharePoint.
2. Verify the URL is a valid SharePoint address for your tenant (correct site path, library or list name, and file name if applicable).
3. Confirm the user has Read (including via groups and permission inheritance).
4. If the issue persists, try another account, clear optional caching for the web part, and contact your administrator or Incode with the steps you tried.

Link showing (but the user should not have access)

1. Re-check effective permissions—the user may have access through inheritance or a group.
2. Review site collection–level permissions.
3. Confirm whether permissions are inherited from a parent container.

Performance and service limits

• Multiple links: each SharePoint target typically requires its own permission check; large sets affect first load.
• Caching: optional browser caching (web part properties) speeds repeat visits; access or link changes may lag until the cache expires or you disable caching.
• Rate limits: Microsoft 365 may throttle heavy SharePoint usage—design pages and caching accordingly.

Best practices

• Use descriptive titles so users know what each link opens.
• Test with accounts that have different permission levels.
• Monitor performance when many links are configured on one page.
• Use optional browser caching on stable pages with many links when a short delay before permission changes appear is acceptable.
• Document which resource types and URLs you publish (especially mixed curated + SharePoint links).

Limitations

• External URLs: not verified like in-tenant SharePoint resources; treat non-SharePoint links as editor-curated (see which links are evaluated above).
• Performance: many SharePoint targets mean many lookups; mitigate with layout choices and optional caching.
• Rate limits: subject to Microsoft 365 / SharePoint throttling.
• Permission inheritance: inherited permissions are included in effective permission checks.
• Dynamic permissions: with caching on, changes may lag until cache expiry or refresh; without caching, updates generally follow the next load or render.