We have a subsite that contains a dozen or so document libraries and want to restrict one user so that they can only access one of them. Obviously I could create custom permissions on all twelve but I want to find a way where we only break the permissions inheritance on that once document library.

Normal users are members of a group that gives them Approve level access to the entire site and I've tried creating a new group that gives the restricted user Approve access to just that document library. The group appears in the site's permissions list as having 'limited access' rights, but when they log into Sharepoint they cannot see the site at all.

EDIT- I've discovered that the user can browse directly to the document library, but cannot open the site's home page or see it in navigation. Is there any workaround for this?

2 Answers 2


To achieve your editied response, you'll need to give the user Read rights to the root of the site/subsite. You'll need to break permissions inheritance from all lists and libraries and remove that person/group from them. You'll be left with the user only having access to the site home page and the document library they need to.


By default, Sharepoint creates 3 Security Groups which automatically filters down to all content below the root site.

These are : Owners, Members, Visitors.

Now, Normally, you would add Authenticated users to the Visitors group so that EVERYONE can view everything.

In order to achieve your purpose, I suggest you create a AD Group for Intranet Users and EXCLUDE ths limited access user from this group.

Next, remove Authenticated users and/or domain users from the Visitors Sharepoint group. Add the newly created Sharepoint Group to the visitors group.

This way, you only need to break inheritance on the specific doc library, and add the 'limited user' to this group with specific permissions.

Hope this helps.


  • That's pretty much what i've done. The problem is that the user ends up with rights to see the document library, but not the site it's in. Commented Jul 22, 2011 at 7:49
  • Why dont you just add the user to the Visitors group in that web? Do This: Browse to Rootsite/etc/etc/sitetobesecured/_layouts/user.aspx . Break Inheritance here. Add 'limited user' to permission here.
    – Fox
    Commented Jul 22, 2011 at 8:11
  • Because that'll then give read access to all the other libraries. Ideally they should be invisible, or at the very least impossible to open. Commented Jul 22, 2011 at 8:13
  • Mmm, I understand your dilemma. Unfortunately there's no easy answer. If only Sharepoint has a "DENY ACCESS" permissions such as NT, the answer would be simple..... You can get very very fancy and go over the top by developing a quick and dirty HTTPModule if you want?
    – Fox
    Commented Jul 22, 2011 at 9:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.