0

We have numerous teamsites in our organization, and each one is essentially a department (HR, ITS, etc). Our users cannot modify permissions directly. Rather, we utilize Active Directory to provide access. If a user is part of a department, they have access to their teamsite.

We have found it is beneficial (ie: required) to allow other users OUTSIDE of the department to access and edit documents within a team site. To accommodate for this, we created a 'shared documents' and allows site admins to modify permissions on folders within it. This is the only place they can modify permissions. A caveat of this is that we need to allow all users access to this library by default (SharePoint works this way for library and folder permissions to work), and when the site admins create a folder within this library, they are to break inheritance, add the users they want, and REMOVE the 'all users' group from the folder.

Of course, any permissions management strategy placed in the hands of the end user is disastrous. We have documents open to everyone, constant tickets generated because they don't know what they are doing, etc. We are looking for an EASY way that will allow teamsite admins to share their documents temporarily with other users in various departments, and provide access in an easy to understand manner.

Has anyone had success with this? We thought about workflows, document workspaces, etc, but all seem quite complex to the end user. We don't necessarily care how complex the solution is, as our ITS team can most definitely build it, but it needs to be almost seamless to the end user.

Thoughts on how to provide access to documents within a 'locked-down' teamsite that is easy for the end user?

  • How about using event receivers or workflows which break permissions and remove all permissions when some folder is created. Then the admin just has to click on share from top ribbon and choose permissions. Though this way you'll still have to give permissions to the library. – Akhoy Oct 13 '15 at 17:05
  • Never thought of event receivers - thank you! I have never built one, but I am guessing it is relatively easy with some research. What did you mean by "Click on Share from the top ribbon"? I don't see that option (?) – Kolten Oct 14 '15 at 15:30
  • Sorry, I meant SP 2013 when I said Share. 2010 has an equivalent "Document Permissions" button. So if you remove the default permissions, they just have to add instead of delete -> add -> delete. – Akhoy Oct 14 '15 at 18:30
  • Kolten, would that be feasible or are you looking for another solution? – Akhoy Oct 16 '15 at 15:35
0

How about creating views instead of folders and using target audience on the view webparts instead of breaking inheritance. or

This might work for you - add a user field (TargetUsersGroup)to the library and set that field to the relevant user group group each time a document is added . Then you can change the view query to show documents based on if users is a member of the TargetUsersGroup.

<Membership  Type="CurrentUserGroups"><FieldRef Name="TargetUsersGroup"/></Membership>
  • 1
    Isn't that to be considered as a major security threat though, and not really solving the issue above – Robert Lindgren Oct 13 '15 at 15:32
  • I see your point - it all depends on how sensitive the information is that is being shared. Target audience is a useful feature to be considered before trying to implement a more complex solution if your information is not highly sensitive!! – HarryB Oct 13 '15 at 15:39
  • Ya, we have our teamsites locked down for privacy issues. (ITS should not see HR documents, etc) – Kolten Oct 14 '15 at 15:30
  • have a look at the second part of my answer - it will only retrieve documents form the database for the intended users. you will only need one view and update its view query as per my answer. – HarryB Oct 14 '15 at 15:33
  • if you want to go down code route then you can further extend this by using item added event receiver where you can break inheritence and apply unique permissions such as giving read permission TargetUsersGroup. This will further enhance your security including controlling the items that appear in the search results. As your info is sensitive event receiver approach will meet your needs. – HarryB Oct 14 '15 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.