I need to apply security setting to a folder in media library. This role should not be able to access any other folder than the assigned one. But the user is a member of another role which has full access to media library. How can we set the access for this user to access only one folder, with out removing him/her from the user group with full access to Media library.

2 Answers 2


Break the security inheritance on a the root where you want to start (in your case probably media library root)

enter image description here

Notice I've added read access rights, you have to assign read for the whole path to your nested folder which you want to make available for your user

Then find your folder that you want to make available and set proper rights (example) enter image description here

Now here is how it is going to look in Access Viewer: enter image description here

  • test - this is my root (settings from first image)
  • a - this is my folder that I've made available for user test (settings from second image)
  • 2
    Hi @HarikrishnanN and welcome to Sitecore Stack Exchange. Please express the usefulness of any answers given through upvoting and downvoting, rather than comments. Thank you :-)
    – Mark Cassidy
    Feb 10, 2017 at 11:16

I would question your governance model here. If a user is a member of a role that has full access to the media library, why do you want to restrict them from access to the full media library? It sounds like they shouldn't be part of that role. Conversely, if you break inheritance to solve this scenario, that means that users that are supposed to have full access to the media library won't be able to access this new folder. Break inheritance is the way to go for your specific question, but the model seems wrong.

Suggested security model

  1. A user with both roles should have access to all, thanks to their 'uber media' role.
  2. A user with just this new role should only see the new folder, not everything. In this case the user in your question should have their 'uber media' role removed.
  3. A user with just the 'uber media' role would see the new folder because they have god mode.

This model assumes your existing role is a 'full access' role as you described, intended to always see everything. You do not need to break inheritance in this model as you will just apply the new role to the new folder and users will naturally inherit permissions.

Elevated access model

However, if this new folder is supposed to be an 'elevated' permission (i.e. most users shouldn't see it, only super-media-admins) then you would need a different model:

  1. A user with both roles should have access to all, thanks to a combo of their 'super-media-admin' role for the new folder and their 'normal-media-guy' role.
  2. A user with just this new 'super-media-admin' role should only see the new folder, not everything. This would mean removing your user from the original role.
  3. A user with just the 'normal-media-guy' role would would see everything but the elevated folder because they are missing the elevated role permission.

In the secondary 'elevated' model, you can use @Alan Płócieniak 's answer to achieve the separation of permission.

  • In my case the user is not a super-media-admin. The user is a normal business user. But unfortunately this is the only group that has restrictions in media library. So the common publisher user that is used have full access to media library. So should I create a new publisher user with restricted access to media library and inherit it to the new role? Feb 10, 2017 at 14:32
  • If you are using the same role for media library and content, and the user needs the original role to continue accessing the content tree, then you will need a new role for them that inherits the content role, but all users will then need new media roles so they can have separate media permissions Feb 10, 2017 at 14:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.