John Day | 17 October 2013
Beware of Geeks bringing gifts. The Site Members have more power in SharePoint 2013 than you may want them to.
I'm so glad we do pilot runs (test runs) of
our courses. Whilst testing the new SharePoint 2013 Site
Administration course with my colleagues Andy Sopel (author of the
SharePoint 2013 Core Skills courses) and Jon Venables (Master of
the SharePoint Designer courses) we stumbled upon a real
For those of your who have used SharePoint 2007 and 2010, you may be well used to Site members getting "contribute" rights. This means they can add, edit and delete items, but they had no say in the management of lists and libraries. Now, in SharePoint 2013 by default they are.
Jon just happened to have a better eye than I when he spotted the new Edit rights permission level was assigned to the site members at the top level of each and every site collection. What does Edit permission level provide? Well, simply put, the same as contribute plus the ability to manage apps. That means create them, modify them and yes delete them! Now at this stage we do not have the fancy features turned on, in fact this version of the server we are using does not have Office Web Apps server so we can see what comes "Out of the box."
But I don't want my members having app power
I agree and so do many others out there. Best practice is always to give less than they need rather than more than they need to begin with. No problem, when a new site collection is created (by you or for you) just follow these simple steps:
- Navigate to the top of the new site collection.
- Click on the settings gear cog in the top right corner of the page and select Site Settings .
- In the Users and Permissions group select Site Permissions .
- Enable check box to the left of your Site Members group name.
- Ribbon select Permissions tab >> Edit User Permissions .
- On the Edit Permissions page:
- Select the Contribute permissions.
- Deselect the Edit Permissions.
- Click OK to complete.
With inheritance enabled these permissions will carry down to any new sub sites you create.
What if I have migrated our SharePoint from 2007
Fear not my fellow SharePointians of old. Your ways have not been tampered with. Your permissions will stay intact and that goes for SharePoint Server On-premise and SharePoint online through Office 365. Lord help Microsoft if they did change your permissions without you knowing, that would completely mess up any governance and regulations you have in place.
Why did they do this?
Good question. There are a lot of speculations around this, mostly pointing towards the fact that members should be encouraged to get more involved creatively with their team. I have my opinions on this and I believe you will too, but putting them aside, this is how it is with SharePoint 2013.
So they've done this with all SharePoint sites
Too early for me to answer on this thoroughly but they have NOT applied this to Publishing sites. Members in publishing sites still have Contribute rights by default when you create a publishing site from scratch but not if you go into a site and enable the SharePoint Publishing Infrastructure site collection feature etc.
So these Edit rights are
of no use?
Not true, edit rights are the perfect level to give to "Power Users" or Super Users. Even if it is not quite enough for your power users, don't forget, less is more. If you don't need them, don't use them.
So go through your site collections and check your members. Have fun!