Is there a way to check if a specific user role has been granted read permission to a specific item?

I've tried using item.Security.CanRead(role) but to no success (this returns true when I'd expect false).


May have been a bit premature with this, I seem to be able to achieve it with;

foreach(var role in roles)
    var accessRules = item.Security.GetAccessRules();
    foreach (var accessRule in accessRules)
        if (accessRule.Account == role && accessRule.AccessRight == Sitecore.Security.AccessControl.AccessRight.ItemRead)
            return true;

but any more succient methods would be good!


1 Answer 1


The code you pasted above is incorrect. It doesn't check roles inheritance.

item.Security.CanRead(role) method is exactly what you're looking for.

If it returns you true when you expect it to return false, most probably you should check:

  • AccessViewer application and see why that role has read access to the item
  • role inheritance - maybe one of the base roles has read access granted
  • check if your code is not used in SecurityDisabler context
  • 2
    Thank you for this, was pulling my hair out trying to grab roles that could read an item during indexing. I assume there is a SecurityDisabler context higher up the execution so I simple wrapped the item.Security.CanRead(role) in a SecurityEnabler() and that did the trick.
    – vandsh
    Jun 14, 2018 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.