0

I´m struggeling a bit with a concept I recently discovered in our own SharePoint 2013.

We have a website with unique permissions and a document library in this site with broken inheritance and therefor also unique permissions.

If I set an user to "read" on the website and to "edit" on the library, all is fine. But when I delete the user from the website, he also is deleted from the permissions of the library.

Is this correct? I always had the impression, that broken inheritance indeed capsulates the permission rights and all changes done after breaking the inheritance are not touched by actions "around" this object?

|improve this question
3

Users need to have access to the site. That's why there is a permission level called Limited Access. Looking at the description of the Limited Access permission levels, you’ll see that it allows users to access objects “when given permissions”. With that permission level they will be able to see the objects they can access, but not the site itself.

Users must have some kind of permissions set on a site level (Limited Access being the lowest level). It must be because managing custom permissions would be a nightmare otherwise. Imagine a user having Read access to the site and then a hundred lists with custom permissions. If you wanted to remove that user from the site, you would need to update all 100 lists. And since removing the user from the site completely will invalidate all custom permissions there is no point in keeping them. I am afraid this is by design.

|improve this answer
  • That is not the problem. It´s not the permission rights, but the fact that the permission (any kind of permission level) of the user is deleted in the library (which has broken inheritance) although I only deleted the user permission on the website. I would suspect that the permission rights of the user on the library should remain, untouched by removing his rights from the website "above" – Ben Feb 12 '16 at 13:23
  • 2
    No, Ben, Paul is correct. To give a user access to a library, the user must have a minimum of "Limited Access" permission to the site. This is because there are objects on the site that are required to display a document library, such as access to master pages and forms required to navigate to or use the Document Library. For this reason, deleting a user's permissions at the site level will absolutely always remove any rights that user has anywhere on the site. If you want to understand it more fully, research the Limited Permissions access level. – Erin L Feb 12 '16 at 14:02
  • Updated my answer. – Paul Strupeikis Feb 12 '16 at 14:02
0

Do not remove the permissions from the site, change them to "limited Access"

That's the minimal level of permission required by a user/group on the site if they are used in broken inheritance locations, Removing them will actually remove them from any location

Having "limited Access" makes the invisible in the permission management

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.