In our SharePoint Online tenancy, we have a site structure like this:
Projects (Site-Collection) │ ┌───────────────┴┬───────────────┐ │ │ │ Alpha-Project Beta-Project ... (SubSite) (SubSite) (SubSites)
Where, we have a site-collection for all our projects with a sub-site for each of the projects. We also have security groups in our AD for each of the project teams and management.
We need to allow all employees to be able to view all sites. However, only the project team should be able to manage their own respective sites. Also, we need the management to be able to contribute to all project sites along with the parent "projects" site-collection.
What I did
- For the view permissions, I added the pre-existing "Everyone except external users" principal to the "Projects" site-collection group "Projects Visitors". I had the understanding that with this all users would be able to view everything.
- Next, I added the "Management" AD group to the "Projects" site-collection group "Projects Members". I had the understanding that this will allow all management people to be able to contribute to all sites.
- Then, for each project sub-site, I broke the inheritance by clicking "Stop Inheritance" on the sub-sites. I had the understanding that this will allow me to provide unique permissions on each of the sub-sites.
- While breaking the inheritance, (on the same page when asked), I created project sub-site group only for "Project Members". This I did by selecting new group for the existing inherited "Projects Members". This group was named "Alpha-Project Members" for the first sub-site. Ditto for other sub-sites. I had the understanding that only the "Members" group needs to be unique and the other two groups (Owners and Visitors) would inherit from the "Projects" site-collection.
- Next, I added the "Alpha-Project-Team" AD group to the "Alpha-Project" sub-site. Same for other individual project sub-sites. I had the understanding that now, only the individual project team members would have contribute permissions on their own project sub-sites; whereas the management would be able to contribute to any site by virtue of inherited "Projects Members" group, along with all employees be able to view all sites by way of inherited "Projects Visitors" group.
How the permissions look like
┌─ Projects Members ─ Management AD Group Projects ─┼─ Projects Visitors ─ Everyone except external users │ └─ Projects Owners ─ Admins AD Group │ │ ┌─ Alpha-Project Members ─ Alpha-Project-Team AD Group (Inheritance broken here) ├─ Alpha-Project ─┼─ Projects Members ─ Management AD Group │ ├─ Projects Visitors ─ Everyone except external users │ └─ Projects Owners ─ Admins AD Group │ │ │ ┌─ Beta-Project Members ─ Beata-Project-Team AD Group (Inheritance broken here) └─ Beta-Project ─┼─ Projects Members ─ Management AD Group ├─ Projects Visitors ─ Everyone except external users └─ Projects Owners ─ Admins AD Group
- However, after having done this I found out that employees are able to view the parent "Projects" site-collection but getting an access-denied on individual project sub-sites.
- Also, the individual project team members were also unable to get access to the individual project sites.
- Even if I add "Alpha-Project-Team" AD group to the "Projects Visitors" SharePoint group on the parent "Projects" site-collection, they get access-denied on their "Alpha-Project" sub-site. Ditto with other project sub-sites.
- However, if I add "Alpha-Project-Team" AD group to the "Projects Visitors" SharePoint group on the parent "Projects" site-collection, then they get access to their own "Alpha-Project" sub-site. Not only this, then they get access to and contribute permissions on all project sites.
I am just unable to grok this permissions conundrum! Where has my understanding gone wrong? How to set these permissions up correctly so that I meet the requirements mentioned above?
After being convinced by @Eric that my understanding was correct and no problems with the way I set up the permissions, I went ahead and opened a ticket. After a lot of time digging around, it was suspected that the custom page layout which was being referenced from the parent site-collection could not get published and was stuck at being unpublished. This caused the access denied to users with read permissions. Users with contribute permissions at parent site-collection were unaffected. Another 5-10 minutes and the problem was resolved. The page layout got successfully published and access was restored.