Media library access settings

Question

I need to apply security setting to a folder in media library. This role should not be able to access any other folder than the assigned one. But the user is a member of another role which has full access to media library. How can we set the access for this user to access only one folder, with out removing him/her from the user group with full access to Media library.

Answer 1

Break the security inheritance on a the root where you want to start (in your case probably media library root)

Notice I've added read access rights, you have to assign read for the whole path to your nested folder which you want to make available for your user

Then find your folder that you want to make available and set proper rights (example)

Now here is how it is going to look in Access Viewer:

• test - this is my root (settings from first image)
• a - this is my folder that I've made available for user test (settings from second image)

Answer 2

I would question your governance model here. If a user is a member of a role that has full access to the media library, why do you want to restrict them from access to the full media library? It sounds like they shouldn't be part of that role. Conversely, if you break inheritance to solve this scenario, that means that users that are supposed to have full access to the media library won't be able to access this new folder. Break inheritance is the way to go for your specific question, but the model seems wrong.

Suggested security model

1. A user with both roles should have access to all, thanks to their 'uber media' role.
2. A user with just this new role should only see the new folder, not everything. In this case the user in your question should have their 'uber media' role removed.
3. A user with just the 'uber media' role would see the new folder because they have god mode.

This model assumes your existing role is a 'full access' role as you described, intended to always see everything. You do not need to break inheritance in this model as you will just apply the new role to the new folder and users will naturally inherit permissions.

Elevated access model

However, if this new folder is supposed to be an 'elevated' permission (i.e. most users shouldn't see it, only super-media-admins) then you would need a different model:

1. A user with both roles should have access to all, thanks to a combo of their 'super-media-admin' role for the new folder and their 'normal-media-guy' role.
2. A user with just this new 'super-media-admin' role should only see the new folder, not everything. This would mean removing your user from the original role.
3. A user with just the 'normal-media-guy' role would would see everything but the elevated folder because they are missing the elevated role permission.

In the secondary 'elevated' model, you can use @Alan Płócieniak 's answer to achieve the separation of permission.