I'm working on creating CMS user roles. The user should only be able to access the content nodes under Tenant and should not see or have access to any other nodes like Layouts, System, Templates, etc.

For this I have created 3 roles:

  1. MyProject Reader - member of Sitecore Client Authoring
  2. MyProject Editor - member of Sitecore Client Designing
  3. MyProject Approver - member of Sitecore Client Publishing

For each of these roles, I have removed the access for the unnecessary nodes like this:

enter image description here

Created a user which has all these roles. When I login as this user, it is as expected. except for the content nodes, none are visible.

But when I select an item, I see this error:

enter image description here

If I give access to the system node, then the system node shows up for this user and the error is also gone.

I do not want the system node to be visible to the user, even when Hidden items option is checked in the top ribbon and also remove this error.

Is this possible?

2 Answers 2


You get this warning since access to items under below folder is required by SXA to function as intended.

/sitecore/system/Settings/Foundation/Experience Accelerator/Upgrade

By default, when you add these roles to user, access to layout, system and templates etc is hidden. Can you check while logging in, hidden checkbox is checked under the View tab.

enter image description here

When this checkbox is checked, these items are visible to the user. Can you uncheck this checkbox and check the behaviour.

You can hide the checkbox under View Tab => Hidden which resides on the following location in the core database with the role.

/sitecore/content/Applications/Content Editor/Ribbons/Chunks/View/Hidden Items

Hope this helps!!!

  • Yes, unchecking hidden items will hide the node, but user can still check and see. right?
    – sukesh
    Apr 24 at 6:29
  • 1
    @sukesh you can hide the View-> Hidden Items tab (/sitecore/content/Applications/Content Editor/Ribbons/Chunks/View/Hidden Items) with the custom role from the core db. This will solve the issue.
    – ckhanna
    Apr 24 at 6:43

As you have explicitly denied inheritance for all the roles, The user who is a member of those roles is not allowed to access those items. Create 1 more role explicitly grants the same access right and apply to a user.

By default, an item inherits the access rights that are assigned to the items that are higher up the content tree (the ancestors). For example, a security administrator can configure the security settings of a single item and all the items that are lower down the content tree (the descendants) automatically inherit the same settings. However, if there is an item that should not inherit any security settings from its ancestors, you can use the Inheritance access right to deny the item the right to inherit the security settings.

If a user is a member of two roles, one that does not allow the user to inherit an access right to an item and another that explicitly grants the same access right, then the user is granted the access right.

Refer to more details: The Inheritance access right

Hope it helps!

  • Thank you but did not understand the solution. For one role, I have given access to system. I still see the error. If I give access for all roles, the system node will be visible to user.
    – sukesh
    Apr 24 at 5:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.