0

I want to restrict department staff to access their department subsite only. I have a single Web app that contains subsites for each department (HR,IT,Finance).

Therefore, on each subsite I choose Stop Inheriting Permissions Inheritance from Site permissions, and add staff to the members group.

What I find strange is that the created staff on the subsite has been added to the parent site and other subsites, so the staff can access other department subsites as well. Am I doing it incorrectly, any ideas?

Improve this question

3 Answers 3

Reset to default
2

Are you using the same group? You must create separate groups for each subsite. Groups are part of the site collection, so the groups will appear in all sites, you will have to grant/remove access as needed.

Improve this answer
2
  • thanks for your answer, maybe a mistake by allowing "NT AUTHORITY\authenticated users" view permission to the site collection, which allowed all users to view other departments .
    – user28393
    Jun 25, 2014 at 8:26
  • also if I create 3 groups in each subsite (ex:HR full, HR contribute & Hr Read) how to allow 'HR Read' group to see only certain document library without allowing "View Application Pages" permission to the "HR read"
    – user28393
    Jun 25, 2014 at 8:49
0

In addition to wjervis who has the right initial answer, you should spit each department into their own site collections. This will prevent accidents like this from happening when you want to keep things separate.

Improve this answer
0

I would suggest you create one site collection for each department, if possible, every site having their own permissions. may be you end up two or 3 site collections.

One issue i am seeing may be the URL, i.e now you are accessing sites http://www.abc.com/ but for 2nd or 3rd site collection if you used manged path then it will be like this http://www.abc.com/sites/hr.

You can also think different url for each site collection using host name site collection.

The issue you mentioned. If you stop inheriting the parent permission in subsite. It just copies the parent permission and display it in subsite. But you can change permission level of the groups available in subsite or add/Remove sharepoint group in subsite, It will not be replicated in the parent site.

But if you Add/Remove users from the sharepoint group in subsite and that sharepoint group was created in parent site then those Add/Remove users changes will be replicated to parent site.

When you break inheritance than you need to remove everybody from permission and add your subsite group in their.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.