Is it possible to give access to a user who is a member of one group but NOT a member of another group?


In other words, if they belong to a certain group, I need to deny them access. I want to create a group of people who are NOT allowed.

Maybe this can be done through code?

3 Answers 3


Permissions in SharePoint are cumulative. If you give access to one SharePoint group there is no way to deny access to some people of this group for whatever reason.

In your scenario you would need to have 3 SharePoint groups for your business groups 1 and 2:

  • members of group 1 but NOT members of group 2
  • members of group 2 but NOT members of group 1
  • members of group 1 AND group 2
  • I have three groups: group1 and group2 have access to the site, but if any are members of group3, I need to exclude them.
    – bgmCoder
    Commented Nov 15, 2012 at 1:36
  • @BGM then you'll need to apply the same logic and create even more SP groups. The key point is that permissions are cumulative, you cannot exclude.
    – Christophe
    Commented Nov 15, 2012 at 1:42
  • So, if I have a site which allows groupA but not groupB, and a subsite with broken permissions that allows only groupB (not groupA), that groupB has access to the site, too?
    – bgmCoder
    Commented Nov 15, 2012 at 3:23
  • @BGM sorry, I am not sure to follow you... If you break inheritance, What you do on a site doesn't affect the other. But I don't see how this is related to your question.
    – Christophe
    Commented Nov 15, 2012 at 5:26
  • Christophe, what I mean is, the group that has permissions to the subsite would not have permissions for the parent. I'm just trying to show an example of the exclusion.
    – bgmCoder
    Commented Nov 15, 2012 at 14:40

One group being a Sharepoint group? If so yes, you'd just make sure the permissions for the site/list/folder/item are set to what you want. If they are inheriting from a parent, you'd need to break the permissions inheritance from the parent and remove the desired group(s).

  • All of the groups are Active Directory Security groups.
    – bgmCoder
    Commented Nov 15, 2012 at 1:37

Okay, all, I found a solution in this post. There is an addon at codeplex that will allow you manage permissions for columns on a particular library or list.

In this fashion, you can allow users into a site, but EXCLUDE them from certain views.

It IS a way of excluding a user from having access instead of including them. I just tried it out on my dev server. You can exclude folks from access to a column or a particular view.

  • this looks interesting, but a word of caution: just hiding columns or restricting regular access to views doesn't mean that the content is protected. A determined user will get access through other paths. From what I understand, this add-on offers "security by obscurity".
    – Christophe
    Commented Nov 15, 2012 at 5:52
  • And for the record, if your initial question was really about column level security, there is one true way to achieve this out of the box: use two different lists and lookups.
    – Christophe
    Commented Nov 15, 2012 at 5:53
  • Christophe, I believe you are right about the security by obscurity thing. (I was trying to keep the question simple, even though my underlying issue was more broad). Your answer is the correct one, even though I think the codeplex addon will suit my needs.
    – bgmCoder
    Commented Nov 15, 2012 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.