Is it possible to customize the subsite to exclude site collection administrators and system accounts from accessing it?

One thing I have tried to do is to have a check via jsom in the masterpage and it works. However, user can bypass this method by halting the loading of the page before the jsom even executed.

  • Why would you want to do that? It defeats the purpose of SCA – Taran Goel Feb 20 '17 at 2:33
  • One of our departments does not want any other users, including IT, to have access to the subsite due to confidentiality of items. – Joe Feb 20 '17 at 2:35
  • Then how are you going to manage the site if something goes wrong? Second create a different site collection all together. – Taran Goel Feb 20 '17 at 2:37
  • I think it won't be the case where in only one subsite will go wrong, most likely it would affect the entire site collection. Similar to my reply to Eric's answer, creating a new site collection is still accessible to the same farm account. I would not go for creating a separate farm for this. – Joe Feb 20 '17 at 2:59

No, that cannot be done. If that is a requirement, then the subsite should be created as it's own site collection.

  • This approach would still grant access to the farm account right? Is there other way to prevent it? – Joe Feb 20 '17 at 2:53
  • The farm account will have access too, there will be no way around that, high privileged accounts will always have access to everything. – Eric Alexander Feb 20 '17 at 3:14
  • Yes that is true, which is why I am thinking if somebody has done a customization of some sort that will be able to check whenever the site is being accessed. Similar to the check on the masterpage without the loophole – Joe Feb 20 '17 at 3:19
  • that isn't true security as you've already noted. If it is that big of a concern, then turn on audit on the site collection, and you'll be able to run reports against anyone you think may have accessed the confidential information. There is no way to deny farm and admin accounts from having access, other than making sure the wrong people don't have those credentials to get in. – Eric Alexander Feb 20 '17 at 3:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.