I have an event receiver on a task list that gets the assigned to people, and grants them 'full control' on that item. Below is the method the event receiver fires, on add and update:

public void AddFullControlUsersToItem(SPWeb subsiteWeb, SPListItem item,     List<SPFieldUserValue> assignedUsers)
            //remove all item permissions
            while (item.RoleAssignments.Count > 0)

            //add permissions to this listitem for the assigned users
            foreach (SPFieldUserValue user in assignedUsers)
                // create role assignment and definition
                SPRoleAssignment assign = new SPRoleAssignment(user.User);
                SPRoleDefinition def = subsiteWeb.RoleDefinitions[DefaultSettings.S_PERMISSION_FullControl];

                // add user permission to subsite
        catch (Exception ex)
            throw new SecurityException("Intervate.CMS.Administration.Security.SecurityRepository", "AddFullControlUsersToItem", "Could not add Full control users to items", ex);

I have noticed that this has the side effect of adding those users directly into the site permissions, with limited access.

User permissions on site level

However when I remove this user from the item (which removes the users permissions) they stay in site permissions :| ??

So I have two questions:

  1. Is there an error in the way I am assigning / removing the permissions that is causing this behavior? and
  2. If there is, how should I fix this?

1 Answer 1


This is SharePoint functionality as designed. SharePoint need to acknowledge Limited Access on sites above the item to allow let-through permissions to the item.

By using SharePoint groups you can avoid this behaviour by doing the following:

  • Create a new SharePoint Group. Assign permissions for the item to the SharePoint group. The group contains the users.
  • Remove permissions from the item to the SharePoint group and remove the group.

Since the group is removed entirely from the Site Collection, the Limited Access permissions are not present.

  • Thanks for this, I think we are going to just have to accept this behavior. It will become a complete management nightmare as more items are added to the list, and the users assigned rights to those items are added to the site level permissions. Jul 9, 2012 at 15:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.