6

Background

  • We have a document library in SharePoint 2013
  • Library inherits permissions from the parent site
  • Library contains nested folders 3-5 levels
  • Documents are stored in leaf level folders
  • Some of these documents are marked as read-only for end users (business requirements dictates this)

Example structure

Document Library
└── Folder 1
   └── Folder 1.1
      └── Document a
      └── [Document b] -- read-only**
      └── Document c
      └── [Document d] -- read-only**
   └── Folder 1.2
      └── [Document e] -- read-only**
      └── Document ...
   └── Folder 1.n...
└── Folder 2
   └── Folder 2.1
      └── Document ...
   └── Folder 2.n...
└── Folder 3
   └── Folder 3.n...
└── Folder n...

** Permission inheritance is 'broken' at the document; Users are granted 'Read' permission to the document directly

  • 'Site Owners' have 'Full Control' over such documents
  • User in question is NOT a 'Site Owner'

Observed Behavior

  • Users cannot delete any of the document read-only to them viz. Documents b, d, e (this is as expected)
  • Users can delete a folder containing a read-only document viz. Folder 1
    • This causes the all the sub-folder and documents, including read-only documents, to be moved the Site Collection's Recycle Bin

Expected Behavior

SharePoint should prevent user from deleting Folder 1 as this implies deletion of documents user does not have rights on to delete

Question

  • Is this the expected behavior in SharePoint?
  • How can I prevent a user from deleting a folder that contains documents read-only to them?
  • check the user permissions on the folders. As well as on the documents. – Niranjan Kulkarni Sep 28 '16 at 7:57
  • User has 'Member' permissions on the folder. However, the folder contains a file that the user does not have permissions to delete. Is this is scenario in which the SP will allow the user to delete a file the user cannot? @NiranjanKulkarni thanks for your inputs! – hitec Sep 28 '16 at 15:00
  • 1
    The answer to your first question ( "Is this the expected behavior in SharePoint?" ) is: YES. – Nils Oct 11 '16 at 10:54
7
+25

When breaking inheritance and granting permission to items, you should always use bottom up approach, where all users when moving from smaller units (item) to bigger units(folder or library) should get less or same permission as their child. In your case the permission should be broken at library level with all users having read access only. Now in each document you should break inheritance only when you need to give higher privileges to any set of users.

Use Link to document instead of actual document

If there are many documents in your library, then you can also try to keep the read only documents into separate library or separate folder with unique permission and give every user read only permission there. Now to maintain your hierarchical structure intact, you could use Link to Document feature, so that in place of the real documents in your structure there will be link to the original document in read-only library/folder. So now even if the folder is deleted only the link will be gone and original document will be intact.

  • Do you see any concerns in the way we have permissions setup? Does this imply that these documents have more permissions than intended? – hitec Oct 4 '16 at 16:45
  • Yes the only concern here is that users have more permission in parent that child. Which kind of makes the less permission given to child obsolete as you mentioned in your question. – Unnie Oct 4 '16 at 16:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.