Can I have subsites inherit permissions from the top node but also add subsite specific permissions without breaking inheritance?

Question

I'm a little confused about how sharepoint permissions are propagated. Leaving inheritance on, I go to my subsite and grant "group1" the read permissions level. But now if I view the permissions at the site collection level I see that group has was given read access there to. So does this mean I can't have some permissions inherited from the root and add uninherited permissions for specific sites? This is how AD permissions works and I'm surprised sharepoint doesn't do this.

With AD permissions inheritance I can do something like this: -Top level folder: group1 read access --Sub Folder: group1 read access (inherited from Top), group2 read access (not inherited) ---Sub Sub Folder: group1 read access (inherited from Top), group2 read access (inherited from Sub Folder), group3 read access (not inherited)

I want to give some groups access at the top of the site collection and have that propagated via inheritance down to all my site. I then want to give other groups access to specific sites without breaking inheritance. Is this possible or am I misunderstanding how this works?

Answer 1

Yes this is expected behavior. but their is workaround of this.

• Create a group on root level without assigning any permission.
• Go to http//serverame/subsite/_layouts/user.aspx (Sub site permission page: subsite--> site settings > site permissions)
• Click on stop inheriting permissions button( BUT dont remove any body from the permission)
• Click on Grant Permissions button. Now you will be prompted to Grant Permission Model dialog window.

• Type the newly created group name(Finance) in the Users/Groups input field

• In the next section Click on Grant user permission directly option box. Now select the permission (e.g contribute) to above mentioned group

• Click on Ok button.