My farm admin encourages us collection admins to use permission inheritance. However, we have hundreds of Limited Access entries on the top level site, all of whom I assume possess a custom permission somewhere in the site collection.

If I allow a subsite to inherit permissions, every one of these LA entries shows up in the subsite. My site owners go crazy trying to wade through these irrelevant LA entries to discern the real security settings for their sites. The LA entries make them think there are 300 people with some kind of access to their site, which is not the case at all.

Does anyone have experience in dealing with this mess? I believe it all started with our upgrade to 2010 Enterprise. I don't recall seeing this in MOSS 2007.

4 Answers 4


Look at it this way...

  • Site 1
    • Library A
    • Subsite 2
      • Library B

Let's assume that we start out inheriting permissions across the board. We add our Owners, Members, Visitors for Site 1. Then we go to Library A, and we add the group "Chief Assistants". This creates a limited access entry on Site 1.

Now, since Subsite 2 inherits from Site 1, it also has the limited access entry for "Chief Assistants". Since Library A does not belong to Subsite 2, removing this Limited access entry is just fine...

TL;DR: Since ALL limited access entries are a result of granting permissions on a parallell level item, they are ALL irrelevant to the subsites. After breaking inheritance, remove ALL limited access entries. Then specialize your permissions.


Copy & paste from documentation, although it doesn't address the question:

Limited Access is a system defined level that SharePoint automatically assigns in the case described here:

Limited Access is a special permission level that cannot be assigned to a user or group directly. The reason it exists is because if you have a library or subsite that has broken permissions inheritance, and you give a user/group access to only that library/subsite, in order to view its contents, the user/group must have some access to the root web. Otherwise the user/group will be unable to browse the library/subsite, even though they have rights there, because there are things in the root web that are needed to render the site or library. Therefore, when you give a group permissions only to a subsite or library that is breaking permissions inheritance, SharePoint will automatically give Limited Access to that group or user on the root web.

  • Understood. My question was really about how admins are dealing with the disruption to the user experience in the circumstance I described.
    – wbco
    Mar 15, 2012 at 14:22

In this case, Microsoft's implementation is rather poor -- when they copy the permissions from the parent, they blindly copy all the Limited Access entries, whether or not they are relevant.

When are they ever relevant, you ask?

We've seen one obscure case in workflows 'assigning tasks', sometimes recipients receive emails with the following message:

"You do not have access"

If SharePoint doesn't realize the recipient really does have access. A limited access grant can work around this bug.


With all due respect, that's not entirely accurate. Even with Owner(Full Control) and Site Collection Admin permissions, you can't grant Limited Access, it's a setting that happens when someone has permissions in one area of a site, but different permissions in another.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.