When you publish a service from an unfederated server as a hosted layer, feature access for the Map service and Feature service can be imported into the Portal separately by using the "Add Content from URL" option. The Portal items created in this manner can be shared independently of one another. For an example, the Map service can be shared with "Organization" and the Feature service can be shared with certain authorized groups for editing. This allows for one service to be used for viewing and editing purposes.
Federation causes this to go out the window. Portal items are automatically created when a service is published to a federated server as a Map Image service and Feature service, but their sharing cannot be set independently. The sharing of these services must match that of the Map Image service. If you want one group of users to view only and another to be able to edit the features, you must publish the same service twice (or more, if you have sub-groups needing to edit certain data) and set each service respectfully.
Publishing one service for each group access level for editing can introduce a tremendous strain on resources through additional ArcSOCs hoarding RAM and publishing one editable service introduces a lot of data integrity issues due to allowing anyone edit capability. If it is possible to separate the sharing levels of Features from the Map Image service, the documentation should be updated to reflect it in the note section here:
https://enterprise.arcgis.com/en/portal/latest/administer/windows/relationships-between-web-services...
Or the ability to provide view/group authorized edits on the single service needs to happen.
