Link to home
Start Free TrialLog in
Avatar of Shirley Mastrorilli
Shirley MastrorilliFlag for United States of America

asked on

Sharepoint - Seperating Access for Sharepoint Administrator

We have a Sharepoint 365 site.  We need to designate an individual in our company to be a Sharepoint Administrator; however there are folders/files that this individual should not have access to.  Is there a way to separate these files so the Administrator only has access to her department's folders?  Our Sharepoint was initially setup as a document library, with only two types of permissions - read and read/write.  It will be reconfigured, but not for about 2 months.
Avatar of Bembi
Flag of Germany image

Hi Shirly,

first at all, SharePoint permissions are additive and you can not deny a permission granted on a higher level.
But you may be able to deny access via web application policy.
The fist role of an Admin is the Farm Administators group, which doesn't include access the site collections but to manage the farm, i.e. to create site collections.
The first option is to grant permissions to content is the user policy of a web application. This grants permission, (i.e  Full, Read, Deny Write, Deny All) on all included site collections or sites.
Second level is the site collection owner of a site collection.
Third level is the group membership within a site / site collection with full permission.

That means, you can remove permission for a farm admin by just not granting (or even explicitely deny) user policy permission on the web application and make sure, the site collection owner is something different than the farm admin.

The lack of this construction is, that it avoids direct permissions on the sites, but the farm admin is able to change the web application policy as well as the site collection owner of a site collection via central administration. 
This way, the farm admin is able grant back himself permissions if he wants to do so.  

Avatar of Walter Curtis
Walter Curtis
Flag of United States of America image

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial