Consider below case for this example.

Content Tree:


RoleA1 - Having access of item A1 and descendants.
RoleA1B1 - Having access of item A1B1 and descendants.

Now, when i create a role RoleA1B1C1 having access of item A1B1C1 and descendants, I want to remove access of this item (A1B1C1) from all other roles like RoleA1, RoleA1B1 etc. without modifying/looping those roles. (Reason not touching those role is number of roles can be in hundreds or thousands).

1 Answer 1


So you want item A1B1C1 to only be accessible by RoleA1B1C1? First thing would be this, I'm assuming that RoleA1B1C1 is inheriting RoleA1B1, and then RoleA1B1 is inheriting RoleA1. Otherwise, depending on your other security, RoleA1B1C1 might not be able to see the ancestor items.

So there's a few assumptions going into this, but if I understand your scenario:

  1. In the Security section for the item, add the Everyone role and set the Inheritance settings to Deny on Item/Descendants.

Break Inheritance on Item for Everyone

  1. Then add the RoleA1B1C1 role and grant Read to Item/Descendants. Note for a quick example, I'm using the sitecore\Developer role, but use your custom role here.

Grant Read to Specific Role

This breaks the inheritance chain so that you have to be a member of that one role to access the item, without explicitly locking out the other roles. If you explicitly deny the other roles, anyone in both RoleA1 and RoleA1B1C1, for example, would be denied access to the item. This way, if someone's crossing roles, they'll have access to the appropriate content.

  • Ken, it might be helpful to post some screenshots of this. I think your answer is correct, but that breaking of the inheritance is not obvious without a screenshot. Just a thought. Commented Feb 15, 2018 at 16:26
  • 1
    Thanks Pete, I've added some reference images. Luckily this very subject came up for me in recent months, I had to learn this same procedure because of Sitecore's default negative permissioning. Commented Feb 15, 2018 at 16:33
  • Yeah, thanks. This is an important concept to teach. I don't think it's covered well enough in the certification classes, and role-based permissions on are so important to get right. It's too easy to just deny access, and not realize that you can't "allow" access after you deny. Commented Feb 15, 2018 at 16:34
  • Ken, you understand it exactly correct. I did the same thing to achieve this. So, basically you have to have a common role in all those roles and from that common role you will deny the access to the item. Was checking if there is inbuilt way to set access rights to none for all roles at once. Thanks for the reply. Commented Feb 15, 2018 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.