Allow users to apply or modify folder/item permissions but not change permissions to the site

Question

I've created a custom SharePoint group that does not allow for users to create groups or grant permissions, however I would like to allow them to control the permissions to specific items, lists or folders. So basically, be able to control permissions content under the site, but not grant or change site permissions.

I looked into it a little and it appears that the 'Manage Permission' variable is all or nothing - if it's unchecked then permissions to content cannot be managed at all but if it is checked, then the users can also grant site permissions to anyone. Including Full Control?

Answer 1

You'll want to do this:

1. Go into the Site Permissions page on your site, go to Permission Levels in the ribbon, and click on Add Permission Level

2. Name the new permission level something that you'll remember (for instance, Manage Permissions), and add nothing but the Manage Permissions right to this. Hit OK.

3. Go to the list in question and click on List Permissions from the ribbon.

4. Click on Stop Inheriting Permissions at the top of the page.

5. Now that you've done that, check the box next to the group you want to grant Manage Permissions access to and click on Edit User Permissions in the ribbon.

6. Add Manage Permissions (or whatever you named that permissions level) to the group and hit OK.

Now you have Manage Permissions set up only for that one list. Please also note that from here on out, any new permissions you add at upper site levels won't cascade down to this list, so if you explicitly grant a user Full Control at the root level, for instance, they will still not be able to access this list unless you add them to the list as well.

Answer 2

Grant that group normal permissions to the root of the site. In places where you want that group to manage permissions, break the list/library permission inheritance from the site and give them the ability manage permissions. This will allow them to manage permissions as needed to the content but not allow them to grant permissions at the root level.