I have a (what I thought is a simple task):
I would like to set permissions on my SharePoint 2013 on-premise as follows:
1. Each department has its own site (e.g Finance, HR, Admin etc)
2. I would like all Staff to be able to browse to each department site
3. The documents library should be accessible to members of the department in question
4. The files/folders in the document library should have List only access to all other
staff except if a particular file/folder has been explicitly shared with them.
Sounds simple right? Here's the problem I have:
Number 1 is done
Number 2 is done
Number 3 is done
Number 4 I have managed to do by granting View Only access to everyone and Read access to the Departmental members as needed.
I am not sure this is the best way to do it but it seems to work. Staff that are not members of the department can access the site, see the list of files but cant open them.
However.... I also have Office Web Apps and if they click the file it shows the contents of the file in Office Web Apps which is pointless if you don't want them to see the contents.
Prime example would be HR site. They have some very sensitive documents that should not be seen by non HR staff but other documents that they wish to share, should be open to all staff. I don't wish to have separate Document Libraries.
How can I achieve this seemingly simple task??
Thanks