SharePoint 2013: Document Library permissions behavior

Question

Background

• We have a document library in SharePoint 2013
• Library inherits permissions from the parent site
• Library contains nested folders 3-5 levels
• Documents are stored in leaf level folders
• Some of these documents are marked as read-only for end users (business requirements dictates this)

Example structure

Document Library
└── Folder 1
   └── Folder 1.1
      └── Document a
      └── [Document b] -- read-only**
      └── Document c
      └── [Document d] -- read-only**
   └── Folder 1.2
      └── [Document e] -- read-only**
      └── Document ...
   └── Folder 1.n...
└── Folder 2
   └── Folder 2.1
      └── Document ...
   └── Folder 2.n...
└── Folder 3
   └── Folder 3.n...
└── Folder n...

** Permission inheritance is 'broken' at the document; Users are granted 'Read' permission to the document directly

• 'Site Owners' have 'Full Control' over such documents
• User in question is NOT a 'Site Owner'

Observed Behavior

• Users cannot delete any of the document read-only to them viz. Documents b, d, e (this is as expected)
• Users can delete a folder containing a read-only document viz. Folder 1
  • This causes the all the sub-folder and documents, including read-only documents, to be moved the Site Collection's Recycle Bin

Expected Behavior

SharePoint should prevent user from deleting Folder 1 as this implies deletion of documents user does not have rights on to delete

Question

• Is this the expected behavior in SharePoint?
• How can I prevent a user from deleting a folder that contains documents read-only to them?

Answer 1

When breaking inheritance and granting permission to items, you should always use bottom up approach, where all users when moving from smaller units (item) to bigger units(folder or library) should get less or same permission as their child. In your case the permission should be broken at library level with all users having read access only. Now in each document you should break inheritance only when you need to give higher privileges to any set of users.

Use Link to document instead of actual document

If there are many documents in your library, then you can also try to keep the read only documents into separate library or separate folder with unique permission and give every user read only permission there. Now to maintain your hierarchical structure intact, you could use Link to Document feature, so that in place of the real documents in your structure there will be link to the original document in read-only library/folder. So now even if the folder is deleted only the link will be gone and original document will be intact.