Sharepoint online folder structure and permission setup

Question

I have a SharePoint website as part of office365 subscription where on the top level of documents section I have folders that should have permissions to be accessed by different groups of people, Say I have 2 folders:

Office/
Client-Contracts/

I would like to let company owners to have access to both folders or the whole website. I would like to let Office-Managers (a security group in our Office365) to have access to the Office folder. I would like to let Project-Managers (a security group in our Office365) to have access to the Client-Contracts folder. I don't want Project-Managers to have access to the Office folder as well as I don't want Office Manager have access to Client-Contracts.

I was able to set that up, using different permission set on those folders. Important is that scheme above is simplified, in fact I have ~20 folders and ~10 different user groups, those have a complicated set of partially overlapping permissions. Also splitting the website into multiple websites with my current knowledge is not desired cause it will complicate workflows for those who should have access to all of those folders.

Now my problem is: that both user groups only have access permissions to those folders, but they don't have access permission to the website itself or to the root folder. Means users can't just navigate to the website in question from SharePoint homepage, they can also not find documents inside that website using search.

I tried searching through sharepoint online docs, but couldn't find anything relevant. I have a feeling that I misunderstand some SharePoint concepts or I'm missing something obvious.

Answer 1

This is how the permission works in SharePoint - if you assign any permission to the granular level and if you don't assign any permission for that user in top level (site), that user will automatically be assigned to limited access permissions .

For example, if you have given permission to a user at list or list item level, but not in site level - in this case, that user will be assigned limited access permission at the site level automatically.

Answer 2

You just give the groups permission to those folders, but don't give permission to the site or to the root folder. That's why users cannot go to SharePoint Homepage.

To solve this issue, you need to give access to these two security groups on the site level. Thus they could access the homepage.

https://docs.microsoft.com/en-us/sharepoint/customize-sharepoint-site-permissions