I'm new to SharePoint and want to know how to give a group of users full access to 3rd level child site (see below) without giving them access to view documents on the 1st level or 2nd level child site. How do i do this?

1st child site - finance 
2nd child site - budgeting 
3rd child site - Company ABC

I come from active directory and NTFS back ground and in that scenario i would give them list access in finance and full access in company ABC. Whats the equivalent in sharepoint?

2 Answers 2


Breaking the inheritance would do the trick. Based on your requirement you need unique permission to your 3rd level child site which is Budgeting. Below are steps

Browse to the Site Permissions page for a Budgeting site (choose Site Actions→Site Settings→Site Permissions).

The Site Permissions page is displayed with a message reading This Web site inherits permissions from its parent.

Click the Stop Inheriting Permissions button in the Permission Tools tab Edit group.

A message window appears reading, in part, You are about to create unique permissions for this Web site.

Click OK.

The Site Permissions page is displayed with a message reading, This Web Site has unique permissions.

The site’s permissions levels and SharePoint groups are no longer Read Only.

Click the Grant Permissions button on the Ribbon to grant permissions to users and groups.

The Grant Permissions dialog box appears.

In the Select Users section, enter the SharePoint Group you want to grant permissions to access the site, list, or library.

This is where you want to use your SharePoint Groups — Site Members, Site Visitors, or Site Owners. What if users are in your group that you don’t want to have permissions to the subsite, list, or library? You need to create a new SharePoint group and grant that group permission to the subsite, list, or library.

In the Grant Permissions section, select the Grant Users Permissions Directly radio button.

Select the permission level that matches the permissions you want to grant. The default permission levels for team sites are Full Control, Design, Contribute, and Read. You can create your own permissions levels by clicking the Permission Levels button on the Ribbon if you need additional groups of permissions.

Click OK.

The users who are members of the SharePoint group you entered in Step 5 are granted permissions.


You always want to grant permissions from the top of you site hierarchy down to the bottom.

  1. The way to do this is to create a new group at the top level. Give it your read permissions. Make sure all of your sites at this time are inheriting the parent. Then new group will post all the way through your sub sites.

  2. For the level at which you want to give higher permissions, break inheritance and remove the group that has the read permissions from the permissions group list.

  3. Click on Grant permissions in the ribbon, and search for the name of the original group you created at the top. This will allow you now to give the group higher permissions than at the parent. Also, you can add to the parent group and it will still propagate through the rest of the sites even though it inheritance is broken.

You want to perform the different permissions layers this way. One of the reason is everyone needs to have access to the top before they can reach the bottom. If you give the permissions at the lower levels without granting them the top first, SharePoint will place "Limited Access" on the top, or if the group/person is not part of the parent, it will create one at the top with Limited Access. This pretty much just means permissions were granted somewhere else besides the parent. This can become a logistics nightmare when it comes to who has permissions to what.

Doing the way outlined above will keep your permissions and permission groups clean.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.