Best Approach to manage permissions for my parent and its sub sites

Question

I have a parent site and 5 sub sites. Any user who can read any of the sub site should be able to read the parent site. But certain users can edit the parent site and specific sub sites.Currently my permission groups looks as follow:-

1. Parent site:-

   • Read (UserA,UserB,UserC)
   • Contribute (Admin)

2. Sub Site One

   • Read (UserB)
   • Contribute (UserA)

3. Sub Site Two

   • Read (UserA,UserB)
   • Contribute (UserC)
   • Etc….

Currently I am managing the security as follow-

1. Each of the Six site (parent site and its 5 sub sites) have unique user groups
2. If new user is added I have to add him to the parent site Read group, and also to the associated sub site Read or Contribute groups.

Considering my current site hierarchy is there a better way to manage the permissions other than having unique security user groups. Baring in mind that the only rules that can always be applies in my current user requirements is that any user who can read any of the sub sites should be able to read the parent site . And no other security rules can always be true in my case.

Answer 1

Unless you use a third party tool or a custom solution, you will need to add your users to the groups manually. SharePoint groups cannot contain other SharePoint groups, so users need to be added to several groups individually. A third party tool or custom code could help automate that.

On the other hand, Active Directory groups can contain other groups, so you could set up a structure with AD security groups and add only the AD groups to the SharePoint groups, instead of individual user names.

AD_Parent_Site_Readers
 - AD SiteA_Contributors
 - AD SiteB Contributors
 - AD SiteC Contributors

AD SiteA Contributors
 - John
 - Mary

AD SiteB Contributors
 - Tim
 - Joan

AD SiteC Contributors
 - Bill
 - Jane

AD SiteA Readers
 - AD SiteB Contributors
 - AD SiteC Contributors

AD SiteB Readers
 - AD SiteA Contributors
 - AD SiteC Contributors

AD SiteC Readers
 - AD SiteA Contributors
 - AD SiteB Contributors

With such a setup, you only ever need to add names to the three site contributor groups in AD. Include the AD groups in the respective Visitors and Members SharePoint groups of the parent and sub sites. With the nested Active Directory functionality, all other other aspects will then be handled by inheritance.