I have created a host named site collection and given a user Site Collection Administrator and Full Control on the site collection level. He is unable to create lists in Site Contents --> Add an App.

THis is a host named site collection on SP 2013 Enterprise with Publishing enabled. The site was created in Powershell and the groups added afterwards. Next to the groups are is the addition of the Limited Access permission level, "Full Control, Limited Access". I have deactivated the "Limited-access user permission lockdown mode" feature on the site colection

I've not come across this before. Any ideas?

  • What about the other users in this site collection? Is the Administrator account performing well? Commented Feb 21, 2020 at 9:38

2 Answers 2


Can you check whether the user has permission in Master Pages and page layouts library. Check the permission in this library at the root site collection and grant them the specified permission level accordingly - at least read permission.

If user has Full Control permission but doesn't have access to the this library, sometimes user faces issue to create list library or page etc.

Similar issue was discussed in the below thread also,

Provide "All Authenticated Users" to Read Only access to the master pages and page layouts library.

Reference :

User with Full Control Permission is getting Access Denied Message

  • This user has Full Control on this library. The Permission level lacks the ", Limited Access' designation on this library, not that it means anything.
    – Arale
    Commented Feb 20, 2020 at 18:35
  • Similar issue in the below thread also discussed, can you give "All Authenticated Users" Read Only access to the master pages and page layouts library.... Reference :sharepoint.stackexchange.com/questions/60699/…
    – SP 2022
    Commented Feb 20, 2020 at 19:04

The user had Full Control on the site collection however, it was also in an AD group that was set to read only on the web applicatoin via the User Policy setting. I had the user removed from that AD group and they were able to do what Full Control accounts do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.