In this section, we are going to cover the basics of creating and using SharePoint permissions. You will continue to work on your example structure: you will set permissions per the company example. You will start with basics about permissions and groups and inheritance, Active Directory and Office 365 Security Groups, SharePoint Groups, and inheritance. Next are sections about setting permissions.
The general flow of this section is that we will introduce concepts and then intermix activities to accomplish a goal. We hope that you, as the reader, will extrapolate a particular action from one of these examples to the problem that you are trying to solve. At least you should see that certain functions and screens exist!
As mentioned above in “Planning, Governance and Initial Setup” it is easiest (and least likely to confuse people in the future) to set unique permissions at Site (or subsite) level (instead of the document library, folder, or document level).
Note
Interactions with SharePoint, including setting permissions, are done through a web browser. This means that you can set Bookmarks/Favorites for both locations (a page or site) and commands (an action). You can also edit the URL to change locations or to open a command for a new site.
Permissions Basics and Groups
Permissions are essentially defined for each individual login. The effective permissions for an individual account are the least restrictive of any permissions that an individual has for a site, page, document library, list, folder, document, etc. This means that you should consider how to test the permissions that you assign.
It is too cumbersome to assign more than one or two individuals to all of the proper items that they should have access to, so the answer is groups. There are several types of groups available to set SharePoint permissions. These include the following:
-
Without DirSync: Office 365 security groups created in the Office 365 Portal
-
With DirSync: These groups appear in the Office 365 Portal as groups, but cannot be edited in Office 365.
-
Active Directory security groups
-
Active Directory mail-enabled security groups
-
Active Directory distribution groups are NOT eligible to be used.
For discussion about creating and maintaining Office 365 security groups and Active Directory synchronization, please see Chapters 8 and 11.
There are tradeoffs between using Office 365/AD security groups and SharePoint groups. The differences between the types of groups are explained below.
-
SharePoint Groups:
-
More closely tied to SharePoint operation (part of SharePoint); the contents of Office 365/AD groups are synchronized with a slight time delay.
-
Editing of permissions can be done entirely by local SharePoint site owners without editing Office 365 Portal security groups or Active Directory.
-
Can contain externally shared userids (see the section “Planning, Governance and Initial Setup”).
-
Can contain Office 365, AD security groups, and AD mail-enabled security groups.
-
A SharePoint group cannot contain another SharePoint group.
There are no out-of-the-box SharePoint tools to review permissions. (There are outside vendors that supply such tools.)
The closest things to reports are:
It is important to plan and document your permissions structure!
With SharePoint 2013 there are SharePoint groups that are automatically created, specifically Owners, Members, and Visitors Groups for each site collection that is created, and for each site (or other entity) that has permission inheritance removed. This can help you keep track of where to place users needing permissions.
Permissions Inheritance
In SharePoint, permissions are inherited from the parent site. This is normally what you want. For your company example, the various sites have different permissions needs. You will “break inheritance” to meet these needs.
Note
It is easy to lose track of where you are setting permissions. To see this, hover over the Web Browser tab, or check the URL to see exactly where you are editing.
The Two Sides of Permissions: Sites and Groups
Permissions are set as the combination of:
-
Sites (where)
-
Groups, which contain people (who)
-
What can be done (Read, Edit, etc.)
The two different screens that deal with the two sides are summarized in Table 5-4.
Table 5-4. SharePoint Permissions: Sites and Groups Summary
Permissions: Site Permissions
This section describes the key steps to set permissions for a site (for other entities see “Set document library Permissions” and “Set a Document’s Permissions” below). Permissions are set for a site by:
-
Adding users to new or existing SharePoint groups associated with the site.
-
Adding Office 365 Portal/AD groups to new or existing SharePoint groups associated with the site.
-
Adding users directly to the site permissions (not recommended).
To set permissions, follow these steps:
-
1.
Navigate to the site.
-
2.
Click Gear ➤ Site Settings.
-
3.
Click Site Permissions (see Figure 5-15).
-
4.
See the Site Permissions screen (Figure 5-16).
-
5.
Perform one of the sets of Permissions Actions described below, based on your needs.
Click “Site permissions” for the next screen (Figure 5-16).
The Site Permission screen is a main control point for setting permissions. There is a similar screen for document libraries, folders, documents, etc. Note that this screen is slightly different if the site inherits permissions from its parent: item 2 will say “Manage Parent” (to go to where the permissions are set) and items 7, 8, 9, and 10 do not appear.
The following is a description of Permissions Screen by number.
-
1.
“Where you are” information: In the title bar, the URL and the tab itself (“Permissions: Sample…”) and if you hover over the tab. It is very easy to be in the wrong place. It is always a good idea to glance up to see where you are.
-
2.
Icon Grant Permissions: Add permissions for a user or group to this list (add permissions to “where you are”).
-
3.
Icon Create Group: You can create a SharePoint group.
-
4.
Icon Edit User Permissions.
-
5.
Icon Remove User Permissions.
-
6.
Icon Check Permissions.
-
7.
Link Manage: Permission Levels.
-
8.
Link Manage: Access Request Settings.
-
9.
Link Manage: Site Collection Administrators.
-
10.
Link “Some content on this site has different permissions”: This warning is generally because of SharePoint structure (see Figure 5-17).
-
11.
Type: SharePoint Group, User, Domain Group
-
12.
Permission Levels: Edit, Full Control, Read are normally used.
-
13.
Automatic SharePoint Groups: Members (Edit), Owners (Full Control) and Visitors (Read) for the (top level) Site Sample_New_Site_Collection were created when the site was created.
Note
Click the hyperlink that is the name of a group to get to the permissions: People and Groups screen for that group. Also, click “Browse” to see the top link bar again.
Icon 2: Grant Permissions
This is the core activity of permissions: to give someone or some group access. In general, you will add an individual to a group on this page (such as one of the groups highlighted in Item 13 in Figure 5-16). You can also add a user or SharePoint Group or Office 365 group with a specific permission level directly to this list. This is an example of power and confusion. It is best for you to pick a mechanism, document it, and use it consistently. Here are your choices:
-
1.
Add the user or group to an existing “standard” group (those ending in Members, Owners, and Visitors). These SharePoint groups have predefined permission levels (Edit, Full Control, and Read, respectively) and are automatically created when the Site is created (or optionally when inheritance is broken; see “Breaking Inheritance” below).
-
2.
Use Office 365 Portal/Active Directory Groups. Add them directly to the list with the appropriate permission level.
-
3.
Use the SharePoint groups that you have created. Add them directly to the list with the appropriate permission level.
-
4.
Add individual users directly to this list. Someone will hate you for this in the future. Because there is no easy permissions cross reference, someone will have to check each site to see where someone has permissions.
There is a new “sharing” mechanism that sets permissions. Share shows up as a user-level function. See Chapter 2 and also the “Set Document Library Permissions” section below.
Icon 3: Create Group
You can create a SharePoint group on a Site Settings screen or a People and Groups screen. The groups are global to the site collection. That is, once created, they can be used anywhere within the site collection. You don’t create a group just for this site, but for all sites in the site collection.
To create a group from a Site Settings screen, follow these steps:
-
1.
Navigate to a site in the proper site collection.
-
2.
Click Gear ➤ Site Settings.
-
3.
Click Site Permissions (see Figure 5-18).
-
4.
Click the Create Group icon.
-
5.
On the next screen, fill in the fields as described.
-
6.
Click Create.
To create group notes, follow these steps.
-
1.
Give your new group a name. It is a good convention to start SharePoint groups with “SP_”. You will appreciate this when you have an environment of mixed SharePoint and Office 365/AD security groups. It helps to know where to look to edit the members. Good luck on getting the editors of the other groups to adopt a standard! (Usually these things have been going on for years and there have been several different people that have an idea of the correct standard.) Underscores are not important here, but you might want to be consistent; either use them or not. The auto-generated group names will have a space before “Members” and such.
-
2.
Document this group’s usage.
-
3.
The group owner defaults to the creator.
-
4.
Do you want to allow requests to join/leave the group? Generally you want to know if you have left someone out (or a new person has joined the firm but has not been added to all of the proper groups). This sends an e-mail to you (or whoever you designate) saying that this person would like access. They can give you a reason. Generally you don’t want auto-accept, except perhaps for a company calendar or some such.
-
5.
Since groups are created in a site collection, this item tells you the site collection in which you are creating the group.
-
6.
Select the permission level(s). We selected “View Only” in this case. These values can be changed; see “Icon 4: Edit User Permissions for Existing Group.” Some selections are redundant. These permissions belong to the group; when you add a group to a site, the members of this group will have these permissions at that site. Having unique permissions on the site does not affect this relationship.
-
7.
Click Create.
Icon 4: Edit User Permissions for Existing Group
Since you have a nice list of groups, the SharePoint designers decided to put “Edit the Permissions of an existing group” here; see Figure 5-19. (This function is in Site Permissions rather than People and Groups.)
To change the permissions for an existing group, follow these steps:
-
1.
Navigate to a site that uses the group.
-
2.
Click Gear ➤ Site Settings.
-
3.
Click Site Permissions (see Figure 5-19).
-
4.
Select the group by marking the checkbox to the left.
-
5.
Click the Edit User Permissions icon.
-
6.
On the next screen, check and uncheck permissions as you desire (see Figure 5-20).
-
7.
Click OK.
Icon 5: Remove User Permissions
You can remove permissions for one or more users or groups by following these steps.
-
1.
Navigate to the site (or item) from which you wish to remove permissions.
-
2.
Click Gear ➤ Site Settings.
-
3.
Click Site Permissions.
-
4.
Verify that you are in the right place!
-
5.
Mark the items (see Figure 5-21).
-
6.
Click the Remove User Permissions icon.
-
7.
Click OK on the warning message.
Icon 6: Check Permissions
Check permissions for a person at this site. See “Check Company Permissions” below for a usage example.
Link 7: Manage Permission Levels
This link documents the particular permission levels. Clicking a link at left shows the exact details.
Link 8: Manage Access Request Settings
Figure 5-22 shows the way to set the e-mail address that will receive requests to access this site.
Link 9: Manage Site Collection Administrators
This is another way to be able to edit the list of Site Collection Administrators. This link only appears when you are on the top site of a site collection and you are a Site Collection Administrator (Figure 5-23).
Permissions: People and Groups
The People and Groups screen describe access to the SharePoint groups for a particular site collection (Figure 5-24).
Click “People and groups” for the next screen (Figure 5-25).
A nice feature of the People and Groups/specific group screen (Figure 5-26) is that if you hover over the small presence indicator (by the name) a floating menu with a link for a contact card appears.
To perform “People and Groups” tasks, follow these steps:
-
1.
Navigate to any site in the appropriate site collection.
-
2.
Click Gear ➤ Site Settings.
-
3.
Click “People and Groups” (see Figure 5-24).
-
4.
If you do not select a specific group, you have these tasks (or select “Groups” at the top left):
-
a.
New ➤ New Group ➤ Create a New SharePoint Group: This is the same as Icon 3: Create Group (see Figure 5-18).
-
b.
Settings ➤ Edit Group Quick Launch: Edit list of groups that appear at the left edge.
-
c.
You can edit many things about a group (except the permissions) with the small Edit icon in the Edit column. (To edit an existing group’s permissions, see “Icon 4: Edit User Permissions for Existing Group”).
-
5.
If you wish to work with a specific group, at the left edge, click a group (click More to see more groups). Once you have selected a group you have a choice of several tasks.
-
a.
New: Add Users (to this group).
-
b.
Actions: E-Mail Users.
-
c.
Actions: Call/Message Selected Users (Lync Message/Call).
-
d.
Actions: Remove Users from Group.
-
e.
Actions: Leave Group (remove yourself from the group).
-
f.
Settings: Group Settings (manage settings such as group name and permissions).
-
g.
Settings: View Group Permissions (view permissions this group has on sites, lists, and items).
-
h.
Settings: Make Default Group (make this group the default group for this site).
-
i.
Settings: List Settings (manage settings such as columns and views).
Next are the descriptions of these tasks.
New: Add Users
This task adds a person (user), or an Office 365/Active Directory security group to the selected SharePoint group. The new person or group will have immediate permissions wherever this group is used.
To add a User or Office 365/Active Directory security group, follow these steps:
-
1.
Select the group.
-
2.
Click New ➤ Add Users (the only choice).
-
3.
In the menu box, verify that you are in the group that you intended. Note that the title is “Share …”. In this case you are adding a user, but the effect is that the new user will have access to wherever the group is used. (See “Settings: View Group Permissions” below.)
-
4.
Enter names, e-mail addresses, or “Everyone” into the box. As you start typing a name or e-mail address, the system looks for matches. Select a name from the drop-down list. Type the next name.
-
5.
Click SHOW OPTIONS; if you wish to send e-mail to the new members leave the “Send an e-mail invitation” box checked.
-
6.
Enter a custom message if you wish.
-
7.
Click Share (see Figure 5-27).
Actions: E-Mail Users
Open an Outlook window to build an e-mail to the names that you select.
Actions: Call/Message Selected Users
Open a Lync communication with the names that you select.
Actions: Remove Users from Group
Remove the names you select from the Group.
Settings: Group Settings
Change this group’s settings including name, About Me, group owner, etc. You might wish to set an e-mail address if you wish to accept member ship requests to the group (see Figure 5-28).
Settings: View Group Permissions
This People and Groups ➤ Settings: View Group Permissions option is a hidden gem (see Figure 5-29).
Note the note: “Use this page to view the permission assignments that this SharePoint group has in this site collection. In addition to the listed URLs, this group has access to any sites, lists, or items that inherit permissions from these URLs.”
The resulting web page dialog box shows the name of the group and each URL (site) to which the group has been assigned and the permission level. (The second part of the note is a warning that all subsites that inherit from these sites also have the same permissions.)
The URLs are hyperlinks to the sites. Click OK to exit.
Settings: Make Default Group
Click to make this group the default group.
Settings: List Settings
Set the settings for the User Information List (Figure 5-30).
Set Top Level Permissions to Read Only
When a site collection is created, no one is given permission, but default SharePoint groups are created. You will add Read Only for all users to allow everyone to see the top-level site. This will allow a safe landing space for users that click Team Site. This permission will be inherited for subsites (unless they have unique permissions).
Here you will set the default permission to Read. With Read, users can view pages and list items and download documents. Follow these steps.
-
1.
Navigate to the top level site, such as Sample_New_Site_Collection.
-
2.
Click Gear ➤ Site Settings.
-
3.
Click Site Permissions (see Figure 5-15).
-
4.
Click Sample_New_Site_Collection Visitors or your Visitors group (see Figure 5-16, item 13).
-
5.
Type “every” into the “Add people” box; pick one of the Everyone options depending upon your needs.
-
6.
Click SHOW OPTIONS; you probably want to turn off “Send an e-mail to everyone.”
-
7.
Click Share. This will add everyone to the group Visitors with permissions Read.
-
8.
Check Permissions (see Figure 5-31).
Set Document Library Permissions
We recommended above to use sites as your basic level of special permissions. In this method, the document libraries within a site would inherit these special permissions. In some cases it is appropriate to set unique permissions for a document library. You will use the document library that is part of the top level site as an sample.
To set unique permissions for a document library, follow these steps:
-
1.
Navigate to the site.
-
2.
Click the title part of the documents (Figure 5-32).
-
3.
Click Library on the Ribbon bar to open the Library ribbon (Figure 5-33).
-
4.
Click Library Settings on the open Library ribbon to show options (Figure 5-34).
-
5.
In Documents ➤ Settings, click “Permissions for this document library” (Figure 5-35).
-
6.
Click “Stop Inheriting Permissions” (Figure 5-36).
-
7.
Accept the message (Figure 5-37).
-
8.
Delete any extra SharePoint groups; add any required groups (grant permissions); undo unique permissions by clicking “Delete unique permissions” (Figure 5-38).
As you can see, there are quite a few steps.
It is important, if you use unique permissions for a document library, that you recognize that Site Settings ➤ Site Permissions work on the SITE, not the document library that you are looking at when you click the Gear icon. You must use most of the steps above to change permissions for a document library.
Click “Documents” to open the next screen.
Click LIBRARY to open the ribbon (Figure 5-34).
Click “Library Settings” to open the next screen.
Click “Permissions for this document library” to open the next screen (Figure 5-36).
Click “Stop Inheriting Permissions.” You will have the message box in Figure 5-37.
Click OK to accept the warning and to open the next screen (Figure 5-38).
Set a Document’s Permissions
We recommended above to use sites as your basic level of special permissions. In this method, the documents within libraries within a site would inherit these special permissions. In some cases, it is appropriate to set unique permissions for a document. You will use the document that is part of the document library of the site Operations/Turnover as an example.
To set unique permissions for a document, follow these steps:
-
1.
Navigate to the document.
-
2.
Click the “…” beside the document (Figure 5-39).
-
3.
A preview of the document shows. Click the “…” at the bottom of the pop-up (Figure 5-40).
-
4.
Click “Shared with” (Figure 5-41).
-
5.
Click ADVANCED (Figure 5-42).
-
6.
Click “Stop Inheriting Permissions” (Figure 5-43).
-
7.
Accept the message.
-
8.
Delete any extra SharePoint groups; add any required groups (grant permissions); undo unique permissions by clicking “Delete unique permissions” (Figure 5-43).
As you can see, there are quite a few steps.
It is important, if you use unique permissions for a document (or folder), that you recognize that Site Settings ➤ Site Permissions work on the SITE, not the document or document library that you are looking at when you click the Gear icon. You must use most of the steps above to change permissions for a document (or folder).
Click the ellipses to open the next screen.
Click the ellipses to open the next screen.
Click “Shared With” to open the next screen (Figure 5-42).
Click “ADVANCED” to open the next screen (Figure 5-43).
Click “Stop Inheriting Permissions” to stop using the permissions of the parent for this document.
Setting Permissions for Your Company Example
We discussed your objectives for this simple company site with specialized permissions above. You are now ready to set the permissions for the sites that you created above. Here are your permissions objectives from Table 5-3 (reproduced here as Table 5-5).
Table 5-5. SharePoint Sites Company Example
To implement the permissions designed above, for each site you will:
-
Navigate to the site.
-
Select Gear ➤ Site Settings ➤ Site Permissions.
-
Click “Stop Inheriting Permissions” (see Figure 5-44).
-
This will automatically create new SharePoint groups (see Figure 5-46).
-
Fill the new groups with the Roles SP_ groups from Table 5-5.
Stop Inheriting Permissions
As discussed above, a site or library by default inherits permissions from its parent. In this security model, you stop inheriting permissions to be able to cleanly start over with specific security groups that have Read Only or Read/Write permission. This model makes it simple to add new users to the correct groups, and minimizes incorrect permission risks.
To stop inheriting permissions, follow these steps:
-
1.
Navigate to the site.
-
2.
Click Gear ➤ Site Settings ➤ Site Permissions.
-
3.
Note the warning that “This library inherits permissions from its parent.” Click “Stop Inheriting Permissions” (see Figure 5-44).
-
4.
Click OK to accept the warning (Figure 5-45).
-
5.
SharePoint automatically gives you the chance to make new groups for your newly un-inheriting site! It wants to build three types of groups: [name] Visitors for people that will have Read Only, [name] Members for Read-Write access, and [name] Owners that have full control, including who will have the ability to add more members to these groups (see Figure 5-46).
-
6.
You will create the standard groups for this site: Procedures Visitors, Procedures Members, and Procedures Owners. You can, using the radio buttons, use other existing groups. Commonly the proper Owners group will already exist; in this case, for example, you might want the same Owners group for all of the sites (the same owners for Procedures, Operations, Board, and Customers). By default the group’s creator name is added to Members and Owners.
-
7.
Click OK to create the groups.
-
8.
You now add the defined SharePoint groups to the proper groups that you just created. As an alternative, you can add the proper people to each of the groups that you just created. It is more about consistency and your long-term plan.
-
9.
Return to the site (Procedures) and select Gear ➤ Site Settings ➤ Site Permissions.
-
10.
As discussed above, you probably want to delete the extra groups, such as Sample_New_Site_Collection Members and Sample_New_Site_Collection Visitors. Leave just Procedures Visitors, Procedures Members, and Procedures Owners.
-
11.
Populate the new groups with the security groups
-
a.
Add SP_Senior_Team, SP_Management and SP_Human_Resources to Procedures Members (for RW access).
-
b.
Add SP_Manufacturing and SP_Customer_Support to Procedures Visitors (for RO access).
-
12.
At some point, fill the SP_ groups with the appropriate people (or other groups).
-
13.
Repeat for the other three sites: Operations, Board, and Customers.
Check Company Permissions
While most people do everything carefully and correctly, it is always a good idea to check. In this procedure you will check the permissions for one of your users, John Q. Demo. He should have Read/Write access to the Procedures document library (from your company security design above).
To check permissions, follow these steps:
-
1.
Navigate to the site (Procedures, in this case).
-
2.
Go to Gear ➤ Site Settings ➤ Site Permissions.
-
3.
Click “Check Permissions” in the Permission Tools ribbon.
-
4.
Enter part of the name, let it autofill, and click the result (see Figure 5-47)
-
5.
Click Check Now.
-
6.
Check results (see Figure 5-48). Note that John Q has permissions via two other groups. They are not higher permissions, so it doesn’t matter. It is good to delete John from these two other groups. (You see that we checked Permissions before we deleted the extra groups in Step 10 above).
-
7.
Check the permissions for the other people.
After you find the person or group that you wish to check permissions for, click Check Now. The next screen shows the results of the check: John Q. Demo the listed permission on this site as given by the listed groups.