SharePoint Permissions - Part 1 ~ Blog moved to www.jasperoosterveld.com

We always get a lot of questions from our customers, even within our own organisation, about the permission structure of a SharePoint portal. This is a pretty important subject because the access to the data in your SharePoint portal depends on it. You don’t want users accessing data they are not allowed to view. The questions that come up are:

How do you add or change permissions?
Do you add the users separately? Or in SharePoint groups?
What about Active Directory groups?
Can I also change the permissions for lists/libraries and items?

In this blog I am going to try to give an answer to these questions. I am always open for input, so please correct me if I am wrong or if you would do it differently.

To understand the architecture of the SharePoint permission structure it is important to know the relation between Active Directory, Active Directory groups, SharePoint users and SharePoint groups.

The Active Directory (AD) stores the profiles of all the employees of a company. These profiles (single user profiles and AD Groups) are imported in SharePoint. From this point an employee can be added as a single SharePoint user or is part of an AD group. These two can be added in a SharePoint group.

To make the explanation a bit easier I am going to use our own Intranet Portal (a modified version of course) as an example. Every SharePoint Portal starts with a homepage. This homepage automatically gets a couple of SharePoint groups named after the homepage. So let’s say the homepage is called Wortell Intranet Home, you will get these three groups:

Wortell Intranet Home Owners
Wortell Intranet Home Members
Wortell Intranet Home Visitors

These three groups, automatically, get the following permissions:

Owners – Full Control
Members – Contribute
Visitors – Read

Full Control gives the user(s) in this SharePoint group administrator permission. The user(s) can create new sites, lists or libraries and change the permissions of the site. Contribute rights makes it possible for the user(s) to add new documents to a document library or create other type of list items. Visitors are only allowed to read the content of the site. That means they cannot add or change documents.

We want all the Wortell employees to be able to read the content of the homepage. I can now use the AD group, in most cases called Domain Users. This group contains all employees and by using it I don’t have to manually add 100 single SharePoint users. Every time an employee leaves or joins the company, he or she is automatically added to this AD group by our IT Service desk. The downside of using an AD group is that you cannot view the users from within the SharePoint Group:

You only see the name of the AD group. In this case this is no problem because we know that all the Wortell employees are in this group. I will now add this group to the Wortell Intranet Home Visitors group. To change the permissions the site administrator can go to Site Actions and Site Permissions. I can click on the Visitors group and start adding the AD group by clicking on New and Add Users:

I can select the AD group by typing the name and verifying it with the People Picker icon or by using the address book. You probably noticed the Send E-mail option. This can be used to send an e-mail to one or multiple users. They get a confirmation that they are now allowed to access the site. This does not work with AD Groups!

The Wortell employees now have access to the homepage and can read the content. Now we can continue with our Intranet Portal by creating a new team site for the SharePoint Team. The permissions of a site can be changed during the creation of a site or afterwards. During the creation of a new site, you can click on More Options and the following screen will appear:

By default every sub site inherits the permissions of the top level site. This means that if I decide not to use unique permissions the SharePoint Team site will use the Wortell Intranet Home Owners/Members/Visitors SharePoint groups. We want to create unique permissions, so I select this option and the following screen appears:

I can create new SharePoint groups for this newly create SharePoint Team site. I recommend keeping the Owner, Members and Visitor naming convention. After you train people in SharePoint permissions they will always know what permissions belong to the SharePoint group.

I want to give all SharePoint team employees contribute permissions so I ask my IT Service desk to create a new AD group and add all SharePoint employees. Every time someone leaves or joins the team that person will be removed or added automatically. I know that only one person, the manager, is going to be the administrator of the site so creating an AD group is overkill. I am just going to add the manager as a single SharePoint user.

I also want all the Wortell employees to be able to visit the site so I don’t need to create a new visitor group. I can reuse Wortell Intranet Home Visitors, because this group contains the AD group with all employees. Don’t create new SharePoint groups if you don’t need to.

The newly created SharePoint Team site has the correct permissions. The manager of the team has full control
permission, the team members can add or change documents and all the other employees are allowed to visit the site and read content.

In SharePoint it is possible to manage permission on three levels:\

Site
List or Library
Items

I just showed the management of the site level but this works exactly the same for lists or libraries. I recommend not changing item level permissions. This will not be easy to manage because there is no out-of-the-box solution that gives you a quick overview of the different permissions for items in lists or libraries. Just create a new list or library if different permissions apply.

Conclusion

Before configuring the permission structure of a SharePoint Portal, I really advise to talk with the customer, or your own employees, about which users/groups need to have permissions and what kind of permissions. Write it in a functional design. For example like this:

SharePoint Groups	AD Groups/Employees	Permissions	Sites
Wortell Intranet Home Owners	John Doe	Full Control	Home
SharePoint Team	SharePoint Employees	Contribute	SharePoint Team

Talk with the IT Service desk about creating AD groups and use them where necessary. I advise to only use AD groups for:

Visitor SharePoint groups were all employees need to have read rights
The member SharePoint groups for department sites.

Are you going to work with project sites? Just manually add SharePoint users. Otherwise your IT Service desk has to create dozens of AD groups and visitors are not able to see which users are in an AD group.

I really hope this blog made the permission structure a bit easier to understand. I am probably going to write a follow-up blog about the permission structure of our customer portal.