I was wondering if someone could help me decide what is the best way of implementing SharePoint permissions for the site I am working on. I am using SharePoint classic on Office365. It is an intranet site with various departments which means we will have unique permissions at almost every level or 1st level sub-site at the least. A sample structure of the site with required permissions is as follows:
0-Home : Admins (AD Group); All Employees (AD Group)
1-Employees : Admins (AD Group); All Employees (AD Group)
2-HR : Admins (AD Group); HR Managers (AD Group); HR Employees (AD Group); username1 (User); adhocemployee1 (User)
3-Managers : Admins (AD Group); HR Managers (AD Group)
3-Staff : Admins (AD Group); HR Employees (AD Group); All Employees (AD Group)
2-IT : Admins (AD Group); IT Employees (AD Group)
1-Non-Employees: Admins (AD Group); All Employees (AD Group); All Non-Employees (AD Group)
where 0,1,2 and 3 are the different levels of sites, 0 being top level site and 3 being the 3rd level sub-site. Since the main permissions we will be using are Read, Contribute and Full Control, I plan to have 3 SharePoint Groups each for every sub-site. So, 3 for Employees, 3 for HR and so on. I am not sure if this is the right approach. Would it be better to have all users/AD groups individually assigned permissions rather than organizing them in groups? We will also have library level permissions assigned to users/AD Groups due to how they are accessed by the people in our organization which makes it a bit complicated and difficult to manage and adhoc requests that come in ever so often for access to certain sub-sites/libraries.
My Approach:
Permissions for HR sub-site HR Admins (Group) -> Full Control -> users: Admins (AD Group)
HR Readers (Group) -> Read -> users: HR Managers (AD Group); HR Employees (AD Group)
HR Contributors (Group) -> Contribute -> users: HR Managers (AD Group); username1 (User)
The other approach which I am not inclined towards is as follows:
HR Managers (AD Group) -> Contribute
username1 (User) -> Read
HR Employees (AD Group) -> Read
Admins (AD Group) -> Full Control
adhocemployee1 (User) -> Read
Hoping someone will be able to tell me which approach is more suitable for my scenario.
Thank you!
