Sub-Site Group Permissions

Background: I have a Parent site with 6 sub-sites, all sub-sites are inheriting the groups from the Parent site.  The Parent has the standard groups: Read, Contribute and Owner and these are inherited by the sub-sites.  However using Designer 2013 I made the following modifications for Sub-Site A: Parent Group (Read Permission)  was set to Contribute permission; Secondly I removed from Sub-Site B the inherited Parent Group with Read Permission since I want to restrict access to it.  SharePoint decided to remove from Sub-Site A and B, but did not remove from Parent Site nor from the other 4 sub-sites.

Two questions:

1. Why would Designer remove from Sub-Site A when the group being removed was in Sub-Site B? and

2. Designer appears to allow different permissions for the same Parent group for the different sub-sites, which solves a couple of problems for sub-site specific permissions, but is this expected behavior? Reading other postings led me to believe that it is best to break the parent inheritance when a different permission requirement is needed for a sub-site.  

Appreciate the guidance here.  

September 14th, 2015 5:54pm

To get a better picture of what you are doing you would need to tell us more about the hierarchy of subsites. I.e., is B a subsite of A, etc.? Where have you broken inheritance?

In general:

  • All groups are scoped to the Site Collection. You can see all groups from any site. (_layouts/15/groups.aspx)
  • Changing the membership of a group in site B will also change the membership in that group in site A. (it's the same group)
  • Groups can be granted permissions to subsites, lists, libraries and folders, when and only when you have broken inheritance at that level. I.e. Group ABC can have Read permissions to one subsite, list, library or folder and have other permissions to other securables.
  • It does not matter which subsite you are in when you add a user to a group. The user will get access to everything that the group has permissions to.
  • Due to inheritance, adding a user or group in one site may grant access to other sites. If you are in a subsite that inherits permissions from its parent site, then adding a user to the subsite will also grant access to the parent site(s) and possibly to subsites below the parent sites

Consider the following site collection. The I sites inherit their permissions from the site above them. The U sites have unique permissions (i.e. they have broken their inheritance from their parent site). If you are managing the permissions of the site indicated with the arrow (or any of the other I sites) then when you add a user to the site the user will have access to all of the sites in the second drawing.

Free Windows Admin Tool Kit Click here and download it now
September 14th, 2015 9:33pm