sharepoint permissions nightmare · users imported from ad 33 permissions site, list, doclib,...

P R E S E N T E R : M A Y A N K M A L I K

H T T P : / / L A T E N I G H T S P . W O R D P R E S S . C O M

SHAREPOINT PERMISSIONS NIGHTMARE

http://latenightsp.wordpress.com/

AGENDA

• What’s the OOB story of permissions ?

• The right way to manage permissions is …

• Is 2010 better?

Contribute

Full

Control

Visitor

Owner

Read Only

Member

Designer Hierarchy Manager

AD Group

SharePoint Groups

Membership

Site Owner

Site Admin

Securable Object

WHAT IS THE OOB STORY OF PERMISSIONS?

MOSS 2007

SP 2010

I DON’T HAVE ACCESS TO THIS SITE


Where ? What ? Who ?



Securable Object Permissions People

Users imported from AD 33 permissions Site, List, DocLib, Item…





Sites

Lists

Personal





Site Permissions (18)

List Permissions (12)

Personal Permissions ( 3)

Sites

Lists

Personal

are applied to








Sites

Lists

Personal

are applied to are assigned








Sites

Lists

Personal


Permission Levels Groups Top-level site /

Inheritance



Securable Objects Permissions People





Sites

Lists

Personal


Permission Levels Groups Top-level site are assigned are applied to

be

lon

g t

o /

are

me

mb

ers

of

are

gro

up

ed

to

ge

the

r in

to

inh

erit

fro

m








Sites

Lists

Personal



be

lon

g t

o /

are

me

mb

ers

of

are

gro

up

ed

to

ge

the

r in

to

inh

erit

fro

m

Inheritance by design








Sites

Lists

Personal



be

lon

g t

o /

are

me

mb

ers

of

are

gro

up

ed

to

ge

the

r in

to

inh

erit

fro

m

Inheritance by design OOTB Permission Levels

- Full Control

- Design

- Contribute

- Read

- Limited Access

- Restricted Read

- Approve

- Manage Hierarchy








Sites

Lists

Personal



be

lon

g t

o /

are

me

mb

ers

of

are

gro

up

ed

to

ge

the

r in

to

inh

erit

fro

m

Inheritance by design OOTB Permission Levels OOTB Groups

- Full Control

- Design

- Contribute

- Read

- Limited Access

- Restricted Read

- Approve

- Manage Hierarchy

- Site name Owners

- Site name Members

- Site name Visitors








Sites

Lists

Personal


Permission Levels Groups – AD / SP Top-level site are assigned are applied to

be

lon

g t

o /

are

me

mb

ers

of

are

gro

up

ed

to

ge

the

r in

to

inh

erit

fro

m

Inheritance by design OOTB Permission Levels OOTB Groups

- Full Control

- Design

- Contribute

- Read

- Limited Access

- Restricted Read

- Approve

- Manage Hierarchy

- Site name Owners

- Site name Members

- Site name Visitors


Decisions:

1. Should they have access to

everything or just this site (securable

object)? Do I need to break

inheritance?

2. Is there an existing permission level

that would suffice? Should I create a

new permission level? What

permissions would be sufficient?

3. Is there a group to which I can add

this user? Should I create a new

group?

SharePoint Site Owner

Who ? What ? Where ?

“I don’t know how to

grant user access to

SharePoint. I have done

it before, but I always

get lost in the UI” - SharePoint Site Owner

1. Where ? 2. What ? 3. Who ?

Securable Object Permissions /

Permission Levels People / Groups

“What in the world is

limited access? ” - SharePoint Site Owner

Company Intranet Top level site

HR Site

HR Onboarding HR Training Site

Finance Site

Payroll

G

P

Limited Access?

Limited Access?


HR Site


Finance Site

Payroll

G

P

P

Limited Access?


HR Site


Finance Site

Payroll

P Read

G

P


HR Site


Finance Site

Payroll

G

P

Limited Access?

P Read

Limited Access

1. View Application Pages 2. Browser User Information 3. Use Remote Interfaces 4. Use Client Integration Features 5. Open


HR Site


Finance Site

Payroll

G

P

Limited Access?

P Read

Limited Access

1. View Application Pages 2. Browser User Information 3. Use Remote Interfaces 4. Use Client Integration Features 5. Open

Effective Permissions: Read, Limited Access

THE RIGHT WAY TO MANAGE PERMISSIONS

The right way to do anything in SharePoint is – “it depends”

The right way to manage SharePoint permissions

• Inheritance is your friend. Inherit whenever you can.

• When breaking inheritance, try to use Groups as much as possible

in order to decrease the complexity of permissions design.

• Use built in roles – Crafted v/s Manufactured

• Use SP groups if your group membership is volatile.

• + one more …








• Define your Access strategy before you setup your site.

Define your access strategy

Project Management

Project

Team Sponsors

Stakeholders

Everyone

Else


Project Management

Project

Team Sponsors

Stakeholders

Everyone

Else

Task List Announcements Shared Documents


Project Management

Project

Team Sponsors

Stakeholders

Everyone

Else


List Documentation List

List

Publications Documentation

Documentation Documentation Publications


Project Management

Project

Team Sponsors

Stakeholders

Everyone

Else



List



P

P


Project Management

Project

Team Sponsors

Stakeholders

Everyone

Else



List



P

P

P

P


Project Management

Project

Team Sponsors

Stakeholders

Everyone

Else


Project Management

Project

Team Sponsors

Stakeholders

Everyone

Else

Everyone

Team

Stakeholders


Project Management

Project

Team Sponsors

Stakeholders

Everyone

Else

Everyone

Team

Stakeholders

P

P P

Site for

Everyone Else

Site for Team

Members Site for

Stakeholders








• Define your Access strategy before you setup your site.

IS 2010 BETTER?

New Permissions Management tools in SP 2010

• View permissions associated with a group at Site Collection Level.

• Show uniquely secured content.

• Check effective permissions for a user / group at a list level.

Questions ?