Is there a way to restrict, for example, an AD group access to a specific site out of the box? For example, I want to restrict access to users to Site A who are not US citizens. Is there a way OOTB or would this be done using custom solution? Any advice or links would be greatly appreciated.

  • 1
    You can use AD groups in your SharePoint groups to govern who has access. Dec 9 '15 at 17:11
  • Create New AD Group Called Contractors or USAilens and use that instead to govern the access NON us citizens Dec 9 '15 at 17:39
  • Do sharepoint know who the users are or are they anonym?
    – Andreas
    Dec 9 '15 at 18:25
  • @allegrooctopus There is already an AD group for these users. How would I execute OOTB?
    – Nina G
    Dec 9 '15 at 18:28
  • @EricAlexander in other words just exclude the AD group in SP groups under site permissions?
    – Nina G
    Dec 9 '15 at 18:29

SharePoint makes it easy to do as each "subsite" contains its' own permissions. In order to achieve your request, you would break inheritance of that subsite from the parent, and only keep the groups you want.

So I don't have to write out all steps, I'm going to c/p from this source: http://www.dummies.com/how-to/content/break-inheritance-permissions-in-sharepoint-2010-t.html

To stop inheriting permissions in a subsite from a parent site, follow these steps:

Browse to the Site Permissions page for a site (choose Site Actions→Site Settings→Site Permissions).

The Site Permissions page is displayed with a message reading This Web site inherits permissions from its parent.

Click the Stop Inheriting Permissions button in the Permission Tools tab Edit group.

A message window appears reading, in part, You are about to create unique permissions for this Web site.

Click OK.

The Site Permissions page is displayed with a message reading, This Web Site has unique permissions.

The site’s permissions levels and SharePoint groups are no longer Read Only.

Click the Grant Permissions button on the Ribbon to grant permissions to users and groups.

The Grant Permissions dialog box appears.

In the Select Users section, enter the SharePoint Group you want to grant permissions to access the site, list, or library.

This is where you want to use your SharePoint Groups — Site Members, Site Visitors, or Site Owners. What if users are in your group that you don’t want to have permissions to the subsite, list, or library? You need to create a new SharePoint group and grant that group permission to the subsite, list, or library.

In the Grant Permissions section, select the Grant Users Permissions Directly radio button.

Select the permission level that matches the permissions you want to grant.

The default permission levels for team sites are Full Control, Design, Contribute, and Read. You can create your own permissions levels by clicking the Permission Levels button on the Ribbon if you need additional groups of permissions.

Click OK.

  • Thank you. I do know how to do that. Unfortunately users who are, for example, non US citizens will not be defined here as there are thousands of them. I was thinking more like, lets say, AD group A contains Non US Citizens and I want to restrict access to them to Site A. Or are you talking about adding AD group A to Full Control Group in default permission level? Please advise.
    – Nina G
    Dec 9 '15 at 17:40
  • Do you want to deny users access to a site / subsite in a web application, or deny access to the entire web application?
    – TempaC
    Dec 9 '15 at 17:56
  • @TempaC I want to deny them access to a site. For example, deny Non US Citizens access to Site A.
    – Nina G
    Dec 9 '15 at 18:30
  • @Aspire27 - How does your permission currently look? Everyone has access to your SharePoint site using via "nt\authenticated_users" ?
    – balowknee
    Dec 9 '15 at 20:35

You will need to write a PowerShell script to match user's property and Add users into an AD group e.g. 'Non Citizen Group' and then assign this Group to SharePoint Site A. If the Site A is a sub-site (not site collection) you will need to break inheritance.

See this link: https://serverfault.com/questions/613004/powershell-script-to-move-aduser-to-appropriate-group-based-on-its-department-id

As far as I am aware, there is no way you can select users based on attribute for permission purposes in SharePoint.

Hope this helps.


This is a theoretical answer that I've not validated nor tested. I don't have a test environment to test this theory. Trying this on a SharePoint environment might very well break it beyond repair! So be advised.

The following theory applies only for the web application in its entirety, not sites in a web application.

Since a SharePoint Web Application is made accessible via an IIS website, it might be possible to use the IIS feature called "URL Authorization".

The URL Authorization feature offers the option to create a Deny Rule. You create a Deny rule when you want to prevent access to Web content for specific roles, groups, or users.

Steps for creating a Deny Rule in IIS:

  1. Open IIS Manager and navigate to the level you want to manage. For information about opening IIS Manager, see Open IIS Manager (IIS 7). For information about navigating to locations in the UI, see Navigation in IIS Manager (IIS 7).
  2. In Features View, double-click Authorization Rules.
  3. In the Actions pane, click Add Deny Rule.
  4. In the Add Deny Authorization Rule dialog box, select one of the following types of access:

    • All users, specifies that all users, whether they are anonymous or identified, can access the content.
    • All anonymous users, specifies that anonymous users can access the content.
    • Specified roles or user groups, specifies that only members of certain roles or user groups can access the content. Type the role or user group in the text box.
    • Specified users, specifies that only certain users can access the content. Type the user ID in the text box.
  5. Optionally, check Apply this rule to specific verbs if you want to require that the users, roles, or groups allowed to access the content can only use a specific list of HTTP verbs. Type those verbs in the text box.

  6. Click OK.

Again, this is something to test in a test-environment that you can afford to lose. I've not tested this in SharePoint.

More information: https://technet.microsoft.com/en-us/library/cc772441%28v=ws.10%29.aspx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.