how do you manage sharepoint permissions?

If you were setting up a shared mailbox for these teams, would you make one mailbox with a bunch of subfolders with unique permissions? Or would you use the highest level administrative unit that you can assign permissions and policies to, to avoid confusion and allow for better management, and make a mailbox for each team/purpose? Ref: https://learn.microsoft.com/en-us/sharepoint/information-architecture-modern-experience Especially "Guiding principle: the world is flat": >"plan to create one site for each discrete topic, task, or unit of work. This will allow you to easily distribute management and accountability for each content collection" If you want a direct NTFS replacement, move these files into a cloud file share. If you want to move them to SharePoint, if you don't do the work now (or get consulting to), you're creating a maintenance nightmare. Modern best practices wouldn't just be a site per team/department, it'd also be separate sites for things like projects, especially cross-team projects. Basically any time you have significantly different permissions you should be strongly considering a separate site. If you do need separate permissions, make a new document library and set custom permissions on that (for manager-only docs as a subset of the overall team or similar... but even then if there's a lot of manager-specific stuff for that team, just make a manager-specific team site. Yes, even if only 2-3 people use it.)