Creating permission levels for a sub site

Question

I have a site collection with one subsite.

I want:

• One user to have contribute permissions for both the site collection and for the sub site.
• A different user to have contribute for just the subsite and visitor for the site collection.

How do I achieve this?

Notes:

• I tried going into the subsite and choosing to stop inheriting from parent but, when I change which user is in which group for the subsite, that still gets applied to the site collection.
• I tried creating a new permission level at the subsite but I don't have an option to do so. Creating a new permission level at the parent doesn't allow me to pick that it should only apply to the subsite and not to the whole site collection.
• I considered having separate site collections as per Contribute permissions for specific parts of a site but we'll end up with so many different site collections that way that I'm worried maintaining consistent master pages and navigation will be a pain.

Answer 1

This is perfectly possible. Here are some short steps to complete this:

1. go to the sub-site > site permissions and stop inheritance
2. Then, on the same page, Create a new group with contribute rights
3. after creating, add user 2 to the group
4. go back to the site permissions of the root site
5. Add user 1 to the contributers (this group is usually called Members)
6. Add user 2 to the viewers (this group is usually called Visitors)

EXTRA!! the group from step 5 should also exist in the subsite and have contribute permissions there.

If there is anything you don't understand from this, just ask...

Answer 2

FYI....

Permissions on securable objects within a site are inherited from the parent object by default. You can break inheritance and use fine-grained permissions — unique permissions on the list or library, folder, or item or document level — to gain more control of the actions users can take on your site. For more information about the best practices for using fine-grained permissions, see Best practices for using fine-grained permissions in technet article or here.

Stopping inheriting permissions copies the groups, users, and permission levels from the parent object to the child object, and then breaks the inheritance. When permission inheritance is broken, all permissions are explicit and any changes to parent object do not affect the child object. If you restore inherited permissions, the child object will inherit its users, groups, and permission levels from the parent again, and you will lose any users, groups, or permission levels that were unique to the child object.

For ease of management, use permission inheritance wherever possible.