Hi,
Just going to give my experience of using site collections / subsites - our users have ZERO access permissions to both the site and subsite level. None. There is nobody in visitors/members and only our projects team with full access.
On the actual SharePoint list, I have the following permissions set:
..and within Visitors/Members there are no members, and the Owners are just the Projects team.
By breaking permission inheritance on the SharePoint lists by granting this group permissions, an entry is created as an exception on the parent sites with 'limited access'.
If I look at the top-level parent site's advanced permissions, I see that the group has been given limited permission, and does not have read access to the site or subsite, but only to specific lists (i.e the ones where I've broken permission and explicitly added them)
Site-level:
If I try edit their permissions:
Then let's move to subsite-level, which in my case inherits its strict permissions from the site collection:
so we can see that the same user group has the same limited access permission levels at site-level:
Then at the List-level I've broken the inheritance and set that group to have contribute access JUST to that list:
So the way I currently do it is to have a site collection which is our data storage 'container' for subsites with no access permissions for standard employees, then each subsite represents a different App (again with no access for standard employees), then within each subsite I may have between 2 and 20+ SharePoint Lists, each with broken permission inheritance that grants that user permissions to edit/add items by giving them contribute rights.
Another great tip is to then change the settings of the Lists to stop them from being found via SharePoint searches, and in the unlikely event that they do guess both the name of the collection and of the subsite, we also disable quick edit & detail edit, and we customise the form to create a Power App that is just one giant button/label, and clicking that opens the actual standalone App.
I hope this information has been helpful!
Cheers,
Sancho
