Blog written by: 
Dhaval Shah
SharePoint & .Net Consultant

Overview

Content Management is one of the major and widely used offerings of SharePoint. SharePoint portals are setup and used effectively for better content management. When the content comes in to the picture, the major area of focus is to present the right set of content to right users. Permission levels in SharePoint helps to define the governance around this.

In this article, we will explore what are permission levels, and best practices on how it can be setup effectively, how to assign permission levels to SharePoint group.

Planning the Permissions

SharePoint consists of many artifacts that represents a site, list, library, list item or document, or folder. These artifacts are generally referred as securable objects. Each of this securable object has its own role assignment. A role assignment represents a user (person) or a group.

SharePoint Permission levels are defined sets of actions a user can execute on a site, list or an item/document.

The permissions can be setup at as:

• Site Permissions
• List Permissions
• Personal Permissions

The permission levels include:

Custom Permission Levels

In the circumstances where out of the box permission levels are not sufficient, we can create custom permission levels as a set of available permission levels. Below are few scenarios, where in we can think of creating custom permission levels:

• Need to define unique set of permissions
• Exclude several permissions from predefined permission level
• Default permission level does not include permission that user should have

Access and Configure Permission Levels

User should have Admin privileges to site collection to access and configure permission levels.

1. Navigate to root site collection
2. Click Site Settings
3. Under Users and Permissions, click Site Permissions
4. The ribbon allows to view and configure the permission levels

5. Click Permission Levels to see the available permission levels

SharePoint Group

SharePoint Group allows to manage set of users at once instead of managing them individually. The group can contain many individual users. Users can be organized in any number of groups depending upon business scenarios.

Below are out of box groups in SharePoint site.

Publishing sites in SharePoint has additional set of SharePoint groups as below

Users in the Members group can contribute to the site by adding or removing items or documents, but cannot change the structure, site settings, or appearance of the site. The Visitors group has read-only access to the site, which means that they can see pages and items, and open items and documents, but cannot add or remove pages, items, or documents.

Monitor and Control

1. Identify and assign the roles to users in SharePoint portal.
2. Define a process to periodically review the assigned permissions.
3. If needed, use any tool for monitoring

Script Intro

In this article, we have developed a PowerShell script to get a ‘Entire Site Collection Permissions Report’ from SharePoint online in CSV format.

This script will:

• Check and print Site Collection (Root) site Permission to the CSV
• Iterates through Sub Sites recursively and print following properties [Site Name, Site URL, Group Name, Group Permission Level] to the CSV

This script will NOT:

• Iterate through Web Application

Note: To run this script one should have Site Collection administrator rights.

The script will iterate through each Site in the provided Site Collection URL. It will also iterate through all the subsites in the Site Collection recursively. Below is the screenshot of the permission report generated in CSV format.

You can download the entire PowerShell script from Here.

Best Practices

Never modify out of box SharePoint permission levels

Refrain yourselves from modifying the out of box permission levels, instead create a new one (use the Make a Copy option) irrespective of major or minor modifications.

Assign Permissions to Groups instead of individual users

Maintain the practice of creating SharePoint Groups and assign permissions to groups. Users can be added or removed from groups as needed and could help reduce ongoing maintenance as users change.

Assign permissions at the highest possible level

Arrange documents that requires unique permissions in document libraries which supports specific group permissions. Use Active Directory (AD) groups whenever possible. Use SharePoint Groups when there may not be an Active Directory group that fits your needs.

Summary

Permission Levels is an integral part of SharePoint permissions management and securing your content in SharePoint.
It is vital to have a solid understanding of Permission Levels used in your environment, and will ensure you and your team know what users can actually do, before they actually do them!

• Author
• Recent Posts

Follow me

Dhaval Shah - MCD, MCSD

SharePoint and Dot Net Consultant at QiPoint

Dhaval Shah (Houston, TX USA) has more than 9 Years of professional experience working as a SharePoint and Dot Net Consultant. He has worked on 30+ projects dealing with more than 15+ clients. He has a special focus on developing and implementing enterprise-level business solutions, built on SharePoint, Dot net and the Microsoft technology stack involving MVC apps, Web API and REST services.

View his professional profile on linked in
https://www.linkedin.com/in/dhavalshah27/

Follow me

Latest posts by Dhaval Shah - MCD, MCSD (see all)

• SharePoint Metadata - October 8, 2018
• SharePoint Permission Levels - August 29, 2018
• SharePoint Online User Permission Reports - March 8, 2018