In our current setup. I am responsible for Sharepoint in our company. This means that I do everything from deploying to application support to giving users rights to the platform when it is required.

My question pertains to giving rights to users. I have sharepoint designer installed and use that to grant users access to the platform. I would like to hand this responsibility over to our Systems security officer.

I was wondering what kind of options I have. Do I ask him to install sharepoint designer and have him give access from there (not something I prefer because that would give way too much control on everything else in his hands) or do I give him permissions to grant permissions via the sharepoint site.

This brings me to the meat of the question: What permissions are required on what level to enable a user to be able to give permissions to the site/libraries etc without actually being able to "contribute" to the site otherwise.

1 Answer 1


It really depends on the business role of the security officer. Ideally, permissions should only be given through the portal or even better through powershell.

While, powershell requires local administrator rights on the farm, its better to do it through the portal in the web browser.

What you essentially need is a site administrator with manage permissions right at the site collection level for the security officer. You should be the site collection administrator which is the highest level of administrative priviledge one can have on a sharepoint site.

Over, the period of time as and when your business demands you can choose to delegate further rights to your security officer in sharepoint through custom permission levels.

  • So I just add him as Site collection Administrators" and that will be enough to grant him permissions to add users to site/groups on the site?
    – sam
    May 24, 2013 at 4:31
  • Add him in the owners group instead of Site Collection Administrator.
    – ArkoD
    May 24, 2013 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.