Permission & Access Issues

How to Protect a SharePoint Subsite from Its Site Owner

Algirdas Jasaitis Oct 14, 2026 868 views

Question details

The user wants to prevent a SharePoint site owner from accessing a confidential subsite after changing permissions.

How to Protect a SharePoint Subsite from Its Site Owner

Product: SharePoint Online
Device & OS: not provided
Scenario: Attempting to protect highly confidential department documents (such as HR or Finance) from higher-level site administrators by modifying subsite permissions.
Observed behavior: Site owners and administrators continue to have access to the subsite's content even after permission inheritance is broken and their group is removed from the subsite.

Before you start

Verify your current site hierarchy and identify which users are assigned as Primary Site Collection Administrators, as their access rights supersede standard subsite permission restrictions.

Solution 1Recommended

Create a Separate SharePoint Site for Confidential Data

Because SharePoint site administrators inherently retain access to all subsites within their site collection, the most secure approach is to migrate confidential information to a completely new, independent site.

In SharePoint Online, breaking permission inheritance on a subsite stops new permissions from cascading down from the parent site. However, it does not revoke the overarching rights of Site Collection Administrators or Parent Site Owners.

To truly isolate confidential data such as HR or Finance records, you must avoid using the subsite structure entirely. Instead, set up a standalone SharePoint site where the parent site owner has no administrative privileges.

Navigate to the SharePoint Start Page

Log in to your Microsoft 365 account, click on the App Launcher (waffle icon) in the top-left corner, and select 'SharePoint'.

Create a New Site

Click the '+ Create site' button. Choose either a 'Team site' (for department collaboration) or a 'Communication site' depending on how you plan to share the confidential documents.

Assign Specific Site Owners

During the setup process, assign only the authorized department leads (e.g., the HR Manager or Finance Director) as the Site Owners. Do not add the previous parent site owner to this new site's membership list.

Migrate Confidential Content

Go to the original subsite, select the confidential files or folders in the Document Library, click 'Move to' or 'Copy to' in the top command bar, and select the newly created site as the destination.

Delete the Old Subsite

Once you have verified that all confidential data has been successfully moved to the new standalone site, navigate to the old subsite's Settings > Site Information > Delete site to remove the vulnerable location.

Create a Separate SharePoint Site for Confidential Data

Information: Depending on your organization's Microsoft 365 governance policies, you may need to request that your global IT administrator create the new standalone site for you.

Free Microsoft Office alternative

Securely Edit and Manage Confidential Documents with WPS Office

While you are restructuring your SharePoint permissions to protect sensitive files, you can use WPS Office as a lightweight, secure alternative to edit and manage your confidential Word, Excel, and PowerPoint documents locally on your device.

1. Download and Install: Visit the official WPS website to download and install the free WPS Office suite on your device.
2. Open Confidential Files Locally: Launch WPS Office and open your downloaded sensitive documents directly from your local drive.
3. Apply Password Protection: Go to the 'Menu' > 'Document Encryption' > 'Encryption' to set a secure password before sharing the document over email or secure networks.

Highly compatible with Microsoft Office formats (.docx, .xlsx, .pptx) to maintain formatting.Edit confidential documents locally without automatically syncing to shared cloud servers.Built-in document encryption allows you to password-protect sensitive files effortlessly.Familiar tabbed interface ensures a seamless transition and immediate productivity.

microsoft office alternative - wps office

Frequently Asked Questions

Why can a SharePoint site owner still see my subsite after I broke permission inheritance?

In SharePoint, Site Collection Administrators and Site Owners hold top-level, absolute permissions over the entire site collection. Breaking inheritance only prevents new permissions from cascading; it cannot revoke the supreme access rights of the administrators.

Can I hide a SharePoint subsite from the parent site owner?

No. Even if you remove a subsite from the navigation menus, the site owner retains administrative control. They can navigate to 'Site Contents' or use admin centers to view, manage, and access any subsite within that collection.

How do I share confidential files without giving access to the primary IT admin?

You must create a completely separate SharePoint Site Collection where the IT admin or parent site owner is explicitly excluded from the Site Owners and Members groups. Permissions must be managed exclusively at this new, independent site level.

What happens if I delete the site owner group from the subsite permissions?

Removing the site owner group from a subsite's permissions page will not restrict Primary Site Administrators. They will still retain override access to the subsite's contents through their inherent site collection administrator privileges.

Document & File Issues