Applying unique permissions to a SharePoint list

Sometimes you will want to apply custom security settings to a SharePoint list to control who has access to it. This recipe shows you how.

Getting ready

This recipe works for:

• SharePoint 2010 Foundation

• SharePoint 2010 Standard Edition

• SharePoint 2010 Enterprise Edition

• SharePoint Online (Office 365 Edition)

You require either the Design or Full Control permission level to edit the permission settings of the list.

How to do it...

1. Select the list that you wish to apply the custom permissions to by clicking on the link to your list in the Quick Launch navigation on the left side of the page.

2. Select the List tab in the List Tools ribbon.

   

3. Select the List Permissions icon in the List ribbon as shown in the following screenshot:

   

4. The current permissions are displayed. You will see that the list is currently inheriting its permissions from the parent site. Select the Stop Inheriting Permissions icon.

   

5. You will be prompted to confirm whether you want to create unique permissions on this list. Click on the OK button to continue.

6. The previously inherited permissions still apply to your list, but any new permission added at the site level will not apply. If you don't want the original permissions, then you now need to remove them. Select the permissions that you do not require (using the tick box) and click on the Remove User Permissions icon on the ribbon.

   Tip

   Don't remove all your permissions from the list—you may lock yourself out from it!

7. You will be prompted to confirm whether you want to remove the selected permissions. Click on the OK button to continue.

8. Now add any new permissions that you want to apply just for this list. Click on the Grant Permissions button on the ribbon. In the dialog box displayed, add the users and permissions that you need.

   

9. The unique permissions that you have assigned to your list are displayed. Review this information carefully to ensure that it is correct.

   

How it works...

Lists inherit their security settings from their parent site (which may in turn inherit its settings from its parent right up to the top of the site collection). The following diagram represents the inheritance hierarchy:

The first step of assigning custom permissions to a list is to break this inheritance. When you break inheritance on the list, the security permission it starts with are the permissions it was inheriting—you actually need to remove these permissions manually after breaking inheritance if you don't want them!

Once you have broken inheritance, you are free to add and remove permissions as you wish.

Use this functionality sparingly. It's generally considered bad practice to use custom SharePoint permissions extensively in your SharePoint sites, as this soon becomes very difficult to manage and control. It is all too easy to make a mistake and to give somebody access to information that they shouldn't see.

Tip

Always test your custom security settings by logging in as different users before you upload sensitive information such as the boards' new salaries. SharePoint will do exactly what you tell it to—get this wrong and you are on your own!

There's more...

Securing individual pages, document libraries, documents, and list items

Exactly the same principles can be used to break inheritance and apply custom permissions to individual pages, document libraries, documents, or list items. Just make sure that you really need to do this before applying custom security throughout your SharePoint sites and always test the changes that you have made.

Alternative ways to secure your sensitive content

There are other approaches you can take to secure sensitive information that might be more appropriate for your needs. One common way to do this is to create a completely separate site (of site collection) for your site collection and only add the users who really need access. That way you can still rely on permission inheritance and you don't have to mess around applying custom permissions further down the hierarchy.

If you want to store your own private documents in a library that only you can see, then your My Site has a specially configured document library, called Personal Documents, already set up and configured specifically for that purpose.

See also

• Determining my permissions in a SharePoint site

• Checking another user's permissions in a SharePoint site

• Adding users to a Team Site, Chapter 2