Why does sharing a folder in Explorer grant full permission on the share to everyone?

A customer noticed that when you use Explorer to share a folder with a specific user, Explorer creates a file share with full permissions to everyone. “Why is this needed? Shouldn’t it be created with permission only to the user that the folder is being shared to?”

Okay, first of all, we should note that there is not a security issue here, because even though the share grants everyone full permissions, the individual permissions on the files and folders are still respected. In order to get access to a file, you need to have access both to the share and to the file. Since you already set up the desired permissions on the file, the share permissions are redundant.

But doing it this way does make things easier for the user.

It reduces the number of elevation prompts, because elevation is required only the first time you share a folder. If you share a folder with multiple people, the second and subsequent sharing operations do not need to elevate because the share already exists with full permissions to everyone.

It reduces the complexity of the sharing operation. Adding or removing a shared file or folder does not require recalculating the ACLs on the share. It also means that the UI for showing what is shared doesn’t need to perform an effective access calculation in order to determine what access level to show. It can operate purely on the file system permissions.

It also makes things easier to understand for the user. Users need to manage only file permissions and don’t have to remember that they also have to combine that with the share permission. Otherwise you get into cases where you shared a file with Bob, and Bob can access it sometimes (when Bob is signed in locally) but not other times (when Bob is accessing the file remotely).

If you really want to deal with share-level permissions, you can use the advanced sharing UI. It’s the simple sharing UI that uses the simple security model.