We are setting up a new SharePoint 2013 environment and are using ADFS for User Authentication. We used the configuration that is described in the following Technet article: https://technet.microsoft.com/en-us/library/hh305235.aspx

At first glance everything seems to be working, but during testing we encountered the following issue:

Every user can access all information inside of SharePoint. Even sites or lists to which they do not have SharePoint permissions.

This seems to be caused by the fact that these users are added to a User Policy which provides them access to the entire web application (as described in the section 'Configure permissions to access the web application').

It seems that the permissions that are granted in the User Policy take precedence over the permissions that are granted in SharePoint itself.

How would we be able to prevent this and let SharePoint permissions take precedence over the policy that are granted in the Web Application User Policy?

2 Answers 2


You would want to remove them from the User Policy. That section of the article is not necessary to have SAML function properly.


When a user added into the web application's user policy then it allow user to control the everything in the web application (All site collections), no matter what permission you have on individual site collections. There are couple of service accounts need to be in the user policy i.e. search crawl or Object cache etc.

Remove the users from the policy of web app, it will not effect ADFS implementation. It is highly recommended never add user's account into policy of web app.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.