I have a sub-site called Operations from where I have revoked access for one of the users so ideally he should not be able to access the site at all. For some reason, after checking on the user's end, he is still able to access the site. This is something we are testing in a test site collection in production for one of the implementations and I am not sure why user is still able to access the site.

Upon checking the permissions for the user on Operations site, I see the below: enter image description here

Does anyone know where these explicit permissions are coming from called "Allow", I guess because of this user is still able to access the site.

Can someone please suggest a solution how can I solve this and make sure user can't access the site, any help is appreciated, thank you in advance.



A) The user is a Site Collection Administrator, or

B) The user was granted permissions at the Web Application level

As you selected the "sharepoint-oline" category, I'm guessing "A".

  • Hi Mike, the user is not a site collection admin, I checked, still same behavior. – mdevm Dec 26 '18 at 13:49

I think he has access at site collection level. So his permissions got inherited to sub-site as well.

  • The user is not a site collection admin. – mdevm Dec 26 '18 at 13:50
  • Also permissions are not being inherited on the subsite, I have unique permissions applied fyi. – mdevm Dec 26 '18 at 14:57

Go to site settings->site collection administrators, check if the user is in site collection administrators. If yes, you need to remove the account from here. enter image description here

  • Hi Kally, the user is not a site collection admin. – mdevm Dec 26 '18 at 13:53
  • how did you remove the user's permission on the susbite? – Kally_MSFT Dec 28 '18 at 7:42
  • Kally, I first stopped permission inheritance and removed all groups from the sub site and gave my account full control. – mdevm Dec 28 '18 at 15:20
  • Go to /_layouts/people.aspx?MembershipGroupID=0, remove the user. after that, check again. BTW, are you using SPO? If not, you need to check the user's permissions at web application level. – Kally_MSFT Jan 1 '19 at 7:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.