Sub-Site Security Inheritance

[toc]

All Sites and Site Collections allow the creation of subsites in their respective site collections. Site Collection Admins (SCA) and Subsite Site Owners should be aware of the dangers of security inheritance. APAN recommends breaking inheritance between a subsite and a parent site collection. Please consult this article for more information.

Permission and Security in Lists and Libraries

By default, all sites, lists, and libraries in a site collection inherit permissions settings from whatever is directly above them in the site hierarchy.  This means a site inherits permissions from the root site of the site collection, and a sub-site inherits permissions from its parent site. A list inherits permissions from the site that contains the list. A list item inherits permissions from the list to which it belongs.

If the default configuration is not changed, permissions are inherited through the whole site collection.  In a way, each element (site, sub-site, list, library, etc.) inherits permissions from the root site of the site collection.

How do I edit permissions for a list, library, or individual item?

If you break permissions inheritance for a list or library and then define new permission settings, the list (or library) becomes a parent for items in it.  The items inherit the new permission settings (unless the items have uniquely defined permissions.

APAN BEST PRACTICE: When applicable, unique list/library or file and folder security can be set; however, APAN recommends to create a new site with unique permissions. This method is easier for community owners to monitor not only content, but also permissions.

How do I break inheritance for a list or library and restrict access to it?

Restricting access to lists or libraries alone can make things complicated for multiple Owners who may not realize these changes have occurred, as access also has to be given not only at the site level but also the individual list or library level.

APAN BEST PRACTICE: Create a sub-site with separate permissions. This way, you can grant access to the entire subsite versus a single library or list for ease of use.

Additional items for your consideration:

• When you break inheritance for a list, the list still has the same permission settings that it did before. To make the list permissions unique, you have to assign new permissions explicitly.
• If you change the permissions for the parent site, those changes are not applied to this list.
• If you change the permissions of the list, all items in the list inherit the changes, unless an item has unique permissions.
• After you stop inheriting permissions, the status bar for the list changes. The message now states, this list has unique permissions.
• In addition, the ribbon buttons change to include Delete Unique Permissions, Grant Permissions, Edit User Permissions, and Remove User Permissions.
• You can reverse this setting and resume inheriting permissions from a parent at any time. If you choose to resume permissions inheritance, you lose any unique permission settings on the content.

How do I delete unique permissions and restore inheritance?

When you break permissions inheritance between a site, folder, list, library, list item or document and its parent you can restore inheritance at any time. However, it is not an APAN best practice to restore inheritance to primary site collections as you may not be aware of the permissions associated to the site collection or parent site.

1. Open the list for which you want to restore permissions inheritance.
2. Under the List tab, Click List Settings.
   1. If you're working with a document library, under the Library tab Click Library Settings.
      
      
3. On the Settings page, under Permissions and Management, Click Permissions for this list.
   1. In a document library, click Permissions for this document library.
4. On the Permissions tab, for a list or library, Click Delete unique permissions.
5. Click Ok. The status bar for the list now reports "this inherits permission from its parent." The name of the parent appears next to the updated status. Remember, custom permissions are lost when you complete this action.

NOTE: If you have restored permissions to an APAN site collection for your community, please contact the APAN Help Desk for immediate assistance. This is not an APAN Best Practice and may cause issues for other sites and or subsites.