Differentiating content for different user groups

Question

Okay, I am new to SharePoint and have been tasked with building a SharePoint site at work that needs different levels of access for 3 different groups of people.

Is it possible for those different groups to effectively have a different view of the site, so they only see the links and pages they can access? Or to 'grey out' links in the hero templates that they can't access?

Or....is it just a case that they won't be permitted to follow the links (so reach an 'access denied') page, which I am trying ideally to avoid.

All advice very gratefully received!

Answer 1

Well, if you're just starting out you'll have some reading to do...you might like to take a look at this post. I like the SP Maven blog, he approaches it from a 'super user' perspective rather than someone with an IT degree (for people like me in fact). Check out his other posts too, he's won awards for his site. OK that's enough trumpet blowing for him.

Familiarise yourself with SP Permissions and the standard Out-Of-The-Box (OOTB) user groups; here is a link to a Microsoft page on security/user groups and a useful slideshow I bookmarked for some concepts.

Specifically to answer your question - what you describe is possible using Audiences, but you'll need to jump on the server to get to Sharepoint Central Administration>Manage Profile Service: User Profile Service Application. I think I'm right in saying Active Directory groups can be used for this, but you can also define rules there yourself. Here is a MS link on audiences. Here's how the menu looks:

Personally I think there is nothing wrong with seeing the 'access denied' pages, there is a mechanism for requesting access to parts of Sharepoint which a user does not have access to. Although I should add the proviso of saying that if your Sharepoint deployment will be multi-site or multi-country, then that could constitute a reason to use Audiences. For instance if you have a Finance department in France and in the UK, then for French users you would probably only want to show the link to the French Finance department for most users and keep the UK Finance department link hidden. (Senior Managers and Sharepoint Admin like you could be put in both the French and UK audience, so you would see links to both Finance sites).

Answer 2

Do NOT Rely On Audiences for Security

( Written 8 years ago, but Still Applies: https://www.itprotoday.com/skype-business/hiding-and-restricting-information-audiences-and-sharepoint-security )

( MSFT Audience Targeting article: https://support.office.com/en-us/article/target-content-to-specific-audiences-33d84cb6-14ed-4e53-a426-74c38ea32293 )

Use the built-in Security Trimming

( https://sharepointmaven.com/permission-driven-security-work-sharepoint-also-known-security-trimming/ )

This is a little bit simplified, but accurate: In the SharePoint databases, each securable page element has a security mask associated with it. Each user also has a security mask with relation to that page element (or even the page itself).

With Each Pageload each of those securable page elements’ security masks are evaluated against that authenticated user’s permissions mask. (Sometimes it takes a CTRL+F5 to not refresh from browser cache).

This security mask is exactly what it sounds like - a mask. If a user has the requisite permissions to at least view that item, the ‘mask’ is lifted - they can see that item.

This concept is implemented entirely throughout a SharePoint Farm.

Even search results are masked from the end user if they do not have the permissions at least view the item that would appear in the search results if they otherwise had the correct permissions to view it.

Also keep in mind: There is NO ’Deny’ security flag of any kind (this is in contrast to windows file shares, for example). A Deny flag would always supersede any other permissions flag.

In SharePoint world this means that a person who has no effective permissions to a resource is denied access.

Navigational elements are masked from the user if they do not have at least view permissions to a single item in the site.

If the end user has a link (e.g.: in an email) and does not have the requisite permissions, they will get a page whereby they can request permissions to access the item.

In most situations (not all - but the vast majority) use segmented security groups. And when those permission groups don’t work for a particular resource, break permission inheritance from its parent and assign new permissions.

Here is a very simple example of what the implications of security trimming are:

-User 1 has View Access to all 3 customer service sites

-User 2 has View Access to the customer service site and the customer service records center

-User 3 has view Access to only the Customer Service site and the Cus

tomer Service Department Site.

User 1:

User 2:

User 3: