0

I'm having some issue with security trimming and the request access page. Thanks in advance for your help.

I am the site owner of a single site allocated to me by the site collection admins.

I have 2 security groups.

  • GRP1
  • GRP2

I have a number of document libraries configured with unique access rights for the groups:

  • LIBA (GRP1 Edit)
  • LIBB (GRP1 Edit)
  • LIBC (GRP2 Edit)
  • LIBD (GRP1 Edit, GRP2 some folder item level security)

Whilst doing some testing we have noticed that a user who is only a member of ONLY GRP2:

  1. Can see LIBA, LIBC, LIBD in the left Navigation - it is my expectation that they should NOT see LIBA
  2. When they follow the link for LIBA they see an empty document library as opposed to the "Request Access" page
  3. If they type in the URL for LIBB they are correctly presented with the "Request Access" page

I've double/triple checked the library permissions page and can't see misconfiguration.

Thanks,

Jon

Improve this question
1
  • Have you used the check permission button in the ribbon? – Jerry_MSFT Dec 24 '20 at 9:22
0

By default, if the test user does not have permission to access LibA, the user shall not be able to view the default navigation link due to the security trimming settings in SharePoint Online. In my test end, it also works like that.

Here I do the permission check for the account Megan, which is a member of GRP2. She has no access to it. enter image description here

And she cannot find the library A link in the navigation.

enter image description here

It is possible that she get permission from groups like site members. It may be better to check it through the check permission button.

Improve this answer
3
  • Hi, I've used the check permissions as suggested and it definitely points towards the answer... LIBA GRP2 PERMISSION = "NONE" Test_User = "Limited Access" LIBB GRP2 PERMISSION = "NONE" Test_User = "NONE" So I now understand that they are picking up rights somehow but I don't understand where from because there is currently just a single file in each library and there is no direct or link sharing configured. I'll investigate further but if you have other ideas it is much appreciated. Jon – Jonathan Axe Dec 24 '20 at 11:54
  • @JonathanAxe. For limited access, it usually means there are file-level unique permission inside the document library. As the test user has access to files in library A, so SharePoint will grant the user limited access to get it. There shall be notifications like "Some content has unique permissions, show these items". Click on the link "show these items" and have a check on them – Jerry_MSFT Dec 25 '20 at 9:07
  • Just to confirm that the user is not a member of the security group with access to the document library. There is only a single file in the document library and I have confirmed that the user has no link or direct share to the document. The only "strange" setting I can see is when I check the user permissions at site level where there is a LIMITED ACCESS Given Directly (which is know about due to a share on a file in a different doclib) but there is also an extra LIMITED ACCESS with no explanation of how it was given in the next column. – Jonathan Axe Dec 29 '20 at 10:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.