Hi all,

I'm relatively new to SharePoint Online, having done a course in it and mostly self-practice since then, but I've never had to create an intranet for a company before and I just got a new job where one of my tasks is to create an intranet for a client using SharePoint Online. (I'm essentially a paid intern.)

Before I give you the rundown, here is the premise and 'heads up':

• I'm aware of the different types of sites, such as Communication and Team sites which include M365 Groups, as well as the sites that don't include M365 Groups (for niche purposes I've heard.)
• I'm aware of the ability to set different permission levels at site level, library/list level, file/folder level, user level (though this is not recommended I've heard), and group level.
• I'm also aware (but not familiar with) Azure AD and having the ability to set separate permissions in the database for internal and external users, as well as some authentication biz you can do.

Here's the rundown:

1. The client has only ever used Windows File Explorer for document storage and email for sharing, never any cloud services. They want to switch to using cloud services as they are a new company and would like to set up an intranet for all their employees-to-come when they grow more. Currently, afaik, they are about 5 strong with 2 of those being the founders.
2. We are trying to set up a SharePoint Online intranet for them where they ideally have separate places for each department, and within those departments they have a section each one can store restricted documents and collaboration in. (For example, HR restricted files would not be accessible by anyone but HR employees and CEO potentially, Finances would have reports only accountants and Managers/CEO could see etc.) The other sections of their departments can be accessible to anyone within the company, but not externally, for when they need to collaborate on things as a company. (Not sure if this is best practice though?)
   1. Suggestions on intranet structure using different SharePoint sites would be helpful.
3. On the point of sharing, I have been trying to figure out the best way to be able to allow one of the founders, for example, to share a restricted document with one person for a limited time that is outside the company, but they need to be authenticated. This whole process kind of goes over my head. From what I've seen, the default permission setting for a SharePoint site/library can be set to a group or level you choose (the CEO/Founders level for example) but if they, on the off chance, need to send a single document to a contractor for say 6 months, is there a way to do this with permissions and Azure AD? I've read through this link from Microsoft, but I think I could use some extra help if possible.

I could use the motto of "Muck around and find out", but I want to do a good job and save time with as few logic/set up mistakes as I can, hence my question here.

Thanks in advance for taking the time to read this and reply if you do.

(If this isn't the correct forum to ask this, please point me to a place I can ask in.)