Why Site Owner permission override Site Collection Administrator permission in SharePoint

Question

I am new to SharePoint & know very little bit about basic SharePoint permission levels.

I know that Site Collection Administrator and Site Owner has almost same permission (Full Control). But, although they are different in some manners

Difference : http://en.share-gate.com/blog/site-owner-vs-site-collection-administrator

But I am confuse when I add same user in Site Owner group which is already site collection administrator, Site Owner permissions override Administrator permission.

First I add User as Site Collection Administrator and check permission. I can see below screen.

Now When I add same user in Site Owner it shows that Site Administrator permission has been override by Site Owner

I don't know why it is something like that? Is user has permission of Site Owner or Administrator or both?

Answer 1

I think you are a bit confused by different terminology used in SharePoint around permissions.
Let me try to clarify the things.

SharePoint has a notion of permission - it's a minimal piece of right the user might have. For example user can edit list item, delete items, manage list, etc. Every piece of "right" represented as one single permission:

• Add Items
• Edit Items
• Delete Items
• Manage Lists
• etc. the list is long

In order to give a user set of permissions, instead of assign each one-by-one, there is a notion of permission level. Permission level combine multiple permissions into one single unit. This permission unit can be later assigned to a user (or group) at the specific level (web, list, item).

For example there is a permission level "Read", it includes following permissions - View Items, Open Items, View Versions, Create Alerts, View Pages, etc. By giving user "Read" permission you are giving whole list of permissions inside "Read" permission level. You can give this permissions to user directly, or through the group (when a user is in the group and group has above permission level).

Here is the list of default permission levels.

Now site collection administrators. There is no "Site collection administrator" permission. Think about site collection admin as a privilege. This privilege gives you "Full control" permission level implicitly. Along this, it gives you some additional administrative options, not available for "Full control" permission level.

The page for checking permissions simply showing permission, and since there is no "Site collection administrator" permission, you will not see it. Technically, in term of permissions, site owner and site collection administrator are equal. But as said before, site admin has some advanced administrative options. When you didn't assign direct access to the site admin, you will see the message that "The following factors also affect the level...." on the check permissions page, because site collection admin is always has Full Control permission level, regardless added directly or not.

Answer 2

A site collection administrator will always have full control when added. Regarding how the check permissions shows different when a user is site collection administrator.

As your user is in site Owner group which has Full control it is displaying just Full control and not any other permission.

You can try to add User to Visitors group which has Read permission(also keep same user in Site collection administrator), you will see that first it will display Read Permission via Visitors Group and then all the rights of Site collection administrator below it.

This is just how SP displays permissions when a user is part of site collection administrator and any site group. It will not affect any permission on site. A user in visitors group(with read access) and also is part of site collection administrator, he will have full control over site and can do anything.

Answer 3

User has both. When you put a user as Site Collection Administrator he will have Full Control permission even if he is a member of the "Visitors" group.