The current situation

We have several department and some of these departments work closely together. Currently we have separate sites for each department. Each site has approx. 8 Document libraries (meetings, procedures, policies etc.) . We have maintained consistency at this level as all sites(departments) have identical library names, folders within are tailored to departments specific needs.

Within each document library of department we have created folders that secure content to specific groups. Rather than give individual permissions to files we have created approx. 6 user groups per department. These groups can be assigned to different resources (folders) with either read or write access.

So in 4 departments we could have up to 24 (4 x 6) user groups with different assignments on resources.

Another problem is that cross departmental access is also required to some files, hence reducing the libraries should help. No tagging is in place currently.

Better System options

I don’t think it’s feasible to retain security without folders in our case, but willing to hear views on this. Therefore I can think of the 3 improvements I can make.

  1. Retain folders for security reasons only
  2. Implement tagging for search and tag based navigation
  3. Consider security as a way of dividing the documents and not content.

The problem is then I will have both folders and a tagging system, the tags will most likely be the name of the folder!

Any recommendation’s welcome.


3 Answers 3


According to me, instead of folders use metadata for identifying the documents.

Firstly instead of 8 document library have 1 document library with metadata as Policy , procedures etc. Next, based on the above option you can further cascade the next level of metadata (which can be specific to each department). This way you have only 1 document library to be maintained for each site.

Using content type is also recommenced.

Use of list columns/ content type can also be used for search configuration.

Cross Department Permission : Provide a column to enter the user name, and using workflow provide the permission to those users. When required, add the user to that column.

  • thanks . please talk about solution of complexity of permission in document library and folders in sharepoint.. second about add a link about metadata and search configs Jul 4, 2013 at 11:31

It is difficult to provide a solution here given the number of variables and the lack of background details but I tend to agree with your statement that you would be better restructuring to get rid of the folders and start using tagging. In my experience, such complex permissions are a result of legacy systems - if users and managers are challenged on this they often struggle to justify why somebody should not see certain content - it is more often because that is the way it has always been.

If you can set up your libraries to meet the permission requirements then use tagging to identify the content you can then create custom views with CQWP or search web parts to present the documents differently if needed. In reality, it does not really matter where something lives as long as users can find it when they need it.


A good way to address this type of problem is to use an Attribute-Based Access Control (ABAC) model. Each criteria (user group, department, type of document, etc.) can be used as an attribute to provide security and access control to the documents/files. ABAC can control access to objects by evaluating rules against the attributes of the entities actions and environment relevant to the requests.

An ABAC solution allows to extend access control to data beyond the roles of the users. You can control data access at a finer-grained level and enables seamless and secure collaboration with partners.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.