I have a Sitecore site that has a section of region pages. I need to create roles for sites that will allow a user to only see their assigned region in the shell. This role should not keep the user from being able to see other regions on the front end though.

Is there a way to separate read access in the shell vs read access on the front end of the site? The site is going to be accessible to anonymous users. The goal of this is to allow a content editor that only has permission to edit a region to still be able to look at the front end of any other region on the site without needing to log out of the shell. I have discussed just not allowing write access to other regions however a requirement is that regions cannot see unpublished data another region has.

2 Answers 2


The security administration should be your friend in anything security related with Sitecore. You can access it here.

Based on your question there should not be any issues in setting up things the way you want BUT you are talking about two different domains: 1- sitecore domain which is the backend 2- extranet domain which is the frontend.

A security account can only be assigned to one domain. If, for example, a user needs to access multiple domains which seems to be your case, you must create separate roles for each domain that they need to access and make the user a member of all the relevant roles to have proper access. You can use the Role Manager to create your roles and the security editor to assign the permissions. With access viewer you can see the permissions for the roles so you can have a good way of seeing which permissions are being set.

Hope this helps


Sitecore uses domains for this purpose: https://doc.sitecore.net/sitecore_experience_platform/setting_up_and_maintaining/security_and_administration/users_roles_and_domains/security_domains

You can use security domains to manage user's access to different parts of Sitecore, for example, if you have multiple websites within a single system.

A Sitecore domain is a collection of security accounts (users and roles) that you can administer as a unit with common rules and procedures. A domain is used to collect security accounts that have some logical relationship, for example, all the accounts that have access to use the Sitecore clients could be stored in the Sitecore domain, whereas all the accounts with access to the published website could be stored in the Extranet domain.

So your users in the shell (Sitecore admin) will not be the same as the users used on the frontend - they will be in a different domain.

Mostly roles are not used over domains, although you should be able to mix roles and domains (and users), but if you would go that way it might become very complex - and probably still impossible for a single user to deny read access in the shell while having read access elsewhere (never mixed these myself).

Edit after comments: if you need a user to have different rights, you need 2 users (one in each domain). But if this is only to have your editors browse the site while editing, this can be achieved by using another browser or by using an incognito window in Chrome (anything that does not uses the same session actually).

  • Can you give an example of how I would go about using this? I tried making 2 roles both with the same name. I set it so the domain of 1 was extranet while the other was Sitecore. I allowed read access for the extranet role while denying read access for the Sitecore role on one of the items in question and assigned these roles to my test user. The read denial overrode the read access as it normally would if they were in the same domain both in the shell and on the front end. Let me know if I'm using them as expected.
    – Teeknow
    Jul 11, 2017 at 20:16
  • Denial will always overrule - you should break inheritance to revoke rights. But as mentioned, I'm not sure even that will work as required. You are mixing the roles and it's an interesting thought (so do try), but I do expect Sitecore to look at the user and take all the roles assigned... which means you will end up with 2 users - one in each domain.
    – Gatogordo
    Jul 11, 2017 at 20:39
  • When I did that the user was granted read access in both the shell and front end. By 2 users do you mean the user cannot be logged into the shell as the user who has had their read access to the items in question revoked/inheritance denied when visiting the front end? That is what I am specifically trying to avoid. The front end of this site is available to an anonymous user so they could technically log out of the shell and see the page but I want to avoid that extra step.
    – Teeknow
    Jul 11, 2017 at 21:03
  • 1
    Indeed. If you want different rights, you'll need different users.
    – Gatogordo
    Jul 11, 2017 at 21:08
  • Give your editors multiple browsers. Or learn them anonymous browser windows.. ;)
    – Gatogordo
    Jul 11, 2017 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.