I was wondering if someone could help me decide what is the best way of implementing SharePoint permissions for the site I am working on. I am using SharePoint classic on Office365. It is an intranet site with various departments which means we will have unique permissions at almost every level or 1st level sub-site at the least. A sample structure of the site with required permissions is as follows:

0-Home : Admins (AD Group); All Employees (AD Group)

1-Employees : Admins (AD Group); All Employees (AD Group)

2-HR : Admins (AD Group); HR Managers (AD Group); HR Employees (AD Group); username1 (User); adhocemployee1 (User)

3-Managers : Admins (AD Group); HR Managers (AD Group)

3-Staff : Admins (AD Group); HR Employees (AD Group); All Employees (AD Group)

2-IT : Admins (AD Group); IT Employees (AD Group)

1-Non-Employees: Admins (AD Group); All Employees (AD Group); All Non-Employees (AD Group)

where 0,1,2 and 3 are the different levels of sites, 0 being top level site and 3 being the 3rd level sub-site. Since the main permissions we will be using are Read, Contribute and Full Control, I plan to have 3 SharePoint Groups each for every sub-site. So, 3 for Employees, 3 for HR and so on. I am not sure if this is the right approach. Would it be better to have all users/AD groups individually assigned permissions rather than organizing them in groups? We will also have library level permissions assigned to users/AD Groups due to how they are accessed by the people in our organization which makes it a bit complicated and difficult to manage and adhoc requests that come in ever so often for access to certain sub-sites/libraries.

My Approach:

Permissions for HR sub-site HR Admins (Group) -> Full Control -> users: Admins (AD Group)

HR Readers (Group) -> Read -> users: HR Managers (AD Group); HR Employees (AD Group)

HR Contributors (Group) -> Contribute -> users: HR Managers (AD Group); username1 (User)

The other approach which I am not inclined towards is as follows:

HR Managers (AD Group) -> Contribute

username1 (User) -> Read

HR Employees (AD Group) -> Read

Admins (AD Group) -> Full Control

adhocemployee1 (User) -> Read

Hoping someone will be able to tell me which approach is more suitable for my scenario.

Thank you!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.