Understanding Site Permissions

Question

I have a SharePoint 2013 (Foundation) Site Collection with a Team Site at its Root.

My "power" users want to provision Sub Sites for collaborations but want the members (who access via extranet using Windows Authentication) of these sub sites to ONLY have access to the Sub Sites they are directly given permission to.

I have broken permission inheritance for each sub site but it seems the only way Sub Site Members can get to these Sub Sites is if I add the Everyone user to the visitors group at the Root Team Site.

Is this normal?

Answer 1

When you create a subsite, it still inherited assets from the root level sites i.e pages, images, logo etc. SO if you add a user in the subsite but dont have the rights on the Asset library, site pages library, Style Library and images library then user will get access denied error.

In order to fix it, you need to add the user into those libraries which is not good.

I would highly recommend that add the NT AUTHORITY\authenticated users & if FBA then all FBA users into the following groups on the root level site collection.

• Style Resource Readers
• Restricted Readers

Answer 2

There are few resources on Parent Site that require permission to access.

Try giving thoses users limited permission on Site Collection root.