Avatar of Shirley Mastrorilli
Shirley Mastrorilli
 asked on

Sharepoint - Seperating Access for Sharepoint Administrator

We have a Sharepoint 365 site.  We need to designate an individual in our company to be a Sharepoint Administrator; however there are folders/files that this individual should not have access to.  Is there a way to separate these files so the Administrator only has access to her department's folders?  Our Sharepoint was initially setup as a document library, with only two types of permissions - read and read/write.  It will be reconfigured, but not for about 2 months.
Microsoft SharePoint

Avatar of undefined
Last Comment
Walter Curtis

8/22/2022 - Mon
Bembi

Hi Shirly,

first at all, SharePoint permissions are additive and you can not deny a permission granted on a higher level.
But you may be able to deny access via web application policy.
The fist role of an Admin is the Farm Administators group, which doesn't include access the site collections but to manage the farm, i.e. to create site collections.
The first option is to grant permissions to content is the user policy of a web application. This grants permission, (i.e  Full, Read, Deny Write, Deny All) on all included site collections or sites.
Second level is the site collection owner of a site collection.
Third level is the group membership within a site / site collection with full permission.

That means, you can remove permission for a farm admin by just not granting (or even explicitely deny) user policy permission on the web application and make sure, the site collection owner is something different than the farm admin.

The lack of this construction is, that it avoids direct permissions on the sites, but the farm admin is able to change the web application policy as well as the site collection owner of a site collection via central administration. 
This way, the farm admin is able grant back himself permissions if he wants to do so.  


ASKER CERTIFIED SOLUTION
Walter Curtis

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Walter Curtis

Thanks
Your help has saved me hundreds of hours of internet surfing.
fblack61