How to permission site - subsite - feature hierarchy

Question

We use the following hierarchy in our SharePoint 2013 collection:
site -> subsite -> feature (the permission to view a certain tab on the subsite)
We need to permission individual users (initially 100 users, user base will grow to about 500) for individual sites, specific subsites and selected features. So user A may be permitted to use site1, subsite1, subsite2 and feature1. User B may be allowed to
also use site1 but only subsite2 and feature2.
I guess it is of no importance, but site and subsite are a true hierarchy, one subsite belongs to exactly one site. The features however are rather unrelated; if someone is permitted for feature 1 then he will permitted for feature 1 in every site/subsite combination.
However, currently we treat the features as if they were in a hierarchy, too.
We currently plan to use individual groups for every combination of security sets and assign the users to a number of such groups. We will end up with approx. 15.000 groups and hundreds of thousand assignments to
these groups. (There are 5 sites, 2000 subsites and 7 features, so the total possible amount of groups is 70.000, but "only" 15.000 are being used). This seems to be flawed.
Ideally we would use joined permissions, e.g. one group per site, one group per subsite and one group per available feature. A certain feature should then only be available to a user, if they are in that feature's group but also in the parent subsite and site
groups.
It is probably obvious that I am far from a Sharepoint expert and I am thankful for any hint concerning our security scenario.

Answer 1

Hi,
Based on your description, my understanding is that you want to set the individual permissions for site, subsite and features(I am not so sure about what a feature you are referring to).
By default, every items will inherited the permission from their parents except you have stopped the inheritance when creating the subsites or items.
So if you need individual permissions for different content, then you may stop the permission inheritance first.
After that, you can modify the permission for each content based on your need, such as creating groups for each content and grant the groups permission to the subsite or the items.
More references:
http://social.technet.microsoft.com/wiki/contents/articles/18203.sharepoint-2013-break-document-library-permissions-inheritance.aspx
http://support.sherweb.com/Faqs/Show/how-to-manage-permissions-in-sharepoint-2013
https://support.office.com/client/Edit-permissions-for-a-list-library-or-individual-item-02d770f3-59eb-4910-a608-5f84cc297782
Thanks,
Victoria
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Victoria Xia
TechNet Community Support