Three checkboxes decide who can touch your team's files. Here is exactly what each one does — including the deny rule that surprises everyone the first time.
Every Synology team folder setup ends at the same screen: a list of users with three choices — Read/Write, Read only, and No access. Choosing well is the difference between a folder the team can work in safely and one where anyone can delete anything. This page explains each level plainly, how DSM combines user and group permissions, and the one rule to remember: deny always wins.
Read/Write means the user can open files, edit them, save changes, upload new files and delete files inside the folder. This is the right level for the people who actually work on those documents every day — and the wrong level for anyone who only needs to look.
Read only lets a user open and copy files but blocks saving changes and deleting. It fits managers who review work, clients you share finished files with, and reference folders like rate cards or templates that should never be edited by the whole office. One honest limit: read only stops changes on the NAS. A user can still copy a file to their own PC and edit the copy — read only protects the original, it does not control the copy.
No access is an explicit deny. DSM applies it above everything else: if a user belongs to a group with Read/Write but is personally set to No access on a folder, they are blocked. Use it deliberately — for example, a temporary staff member who should reach the team folder but never the accounts folder. Because deny is so strong, also use it carefully: an accidental deny on the wrong person locks them out completely.
When permissions come from more than one place, DSM resolves them in a simple, strict way:
This is why the setup order matters: grant through groups for the common case, then use a direct user deny only for the exceptions.
DSM shared folder permissions are set on the top-level folder and cover everything inside it. Open Control Panel → Shared Folder → Edit → Permissions and set the level per user or group. If one subfolder inside needs different rights, that is a separate, advanced topic (DSM Advanced Permissions or Windows ACL) — do not expect the simple permission screen to do per-subfolder rules.
See the full setup live — creating the folder, setting permissions and verifying access with a second user.
▶️ Watch Full VideoThey are blocked. In DSM, a No access (Deny) entry overrides every allow, whether the allow comes from the user entry or from any group the user belongs to.
Yes. Read only prevents changing or deleting the original files on the NAS, but opening and copying them is allowed by design. If a file must never leave the building, it should not be readable by that user at all.
Not with the standard shared folder permission screen — it controls the whole shared folder. Different rights on a subfolder need DSM Advanced Permissions or Windows ACL settings, which is a more advanced setup.