Do NOT Rely On Audiences for Security
( Written 8 years ago, but Still Applies: https://www.itprotoday.com/skype-business/hiding-and-restricting-information-audiences-and-sharepoint-security )
( MSFT Audience Targeting article: https://support.office.com/en-us/article/target-content-to-specific-audiences-33d84cb6-14ed-4e53-a426-74c38ea32293 )
Use the built-in Security Trimming
( https://sharepointmaven.com/permission-driven-security-work-sharepoint-also-known-security-trimming/ )
This is a little bit simplified, but accurate:
In the SharePoint databases, each securable page element has a security mask associated with it. Each user also has a security mask with relation to that page element (or even the page itself).
With Each Pageload each of those securable page elements’ security masks are evaluated against that authenticated user’s permissions mask. (Sometimes it takes a CTRL+F5 to not refresh from browser cache).
This security mask is exactly what it sounds like - a mask. If a user has the requisite permissions to at least view that item, the ‘mask’ is lifted - they can see that item.
This concept is implemented entirely throughout a SharePoint Farm.
Even search results are masked from the end user if they do not have the permissions at least view the item that would appear in the search results if they otherwise had the correct permissions to view it.
Also keep in mind: There is NO ’Deny’ security flag of any kind (this is in contrast to windows file shares, for example). A Deny flag would always supersede any other permissions flag.
In SharePoint world this means that a person who has no effective permissions to a resource is denied access.
Navigational elements are masked from the user if they do not have at least view permissions to a single item in the site.
If the end user has a link (e.g.: in an email) and does not have the requisite permissions, they will get a page whereby they can request permissions to access the item.
In most situations (not all - but the vast majority) use segmented security groups. And when those permission groups don’t work for a particular resource, break permission inheritance from its parent and assign new permissions.
Here is a very simple example of what the implications of security trimming are:
-User 1 has View Access to all 3 customer service sites
-User 2 has View Access to the customer service site and the customer service records center
-User 3 has view Access to only the Customer Service site and the Cus
tomer Service Department Site.