I have an extranet where, by default, I've denied permissions to the whole tree to the anonymous account to ensure a login. One of the subitems is content only for staff who have access, rather than general members. However, people can be assigned to both the Member and Staff roles.

On my item, I've got Members denied access and Staff granted access, which means if you're assigned to both, you're denied access. Is there any way to invert this, or another way of doing the permissions to accomplish the goal? I would think this a common scenario...

1 Answer 1


You should try to avoid denying access (just because of the fact that deny gets preference over all) - it's not a good practice. It's better to break the inheritance to remove access. This way, your "grant" will work again as there is no "deny" anymore to remove it.

You can find more information here and specifically on the use of inheritance here. That last page should be very interesting for your case as it covers that (and similar) scenario's with examples.

  • 1
    I tried to assign things as specified, but I get the same result. The documentation is working off a single role premise, where my case involves two roles on the same account. Either way I set the permissions up, I see they're denied access if they're a Member, but granted access if they're a Staff. But if someone is -both- then they're denied access, when they should be granted access still. Which seems contrary to how Sitecore wants to work. Commented Nov 23, 2016 at 16:55
  • And what do you get as reason for the deny?
    – Gatogordo
    Commented Nov 23, 2016 at 16:57
  • I think I have it working, I may have missed a step earlier (it's a bit confusing at first). So here's what I did. For Members, on Home, I set Read: Allow Item and Deny Descendants, with no inheritance settings. On all of the subitems I didn't want affected, I set up Read: Allow Item and Allow Descendants (no inheritance still). For the subitem I want to block, I left it blank. Then for Staff, I set up an explicit Allow Item and Allow Descendants (no inheritance) on the blocked subitem. When I went to my account with both permissions, I had access. Commented Nov 23, 2016 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.