If a user has both group-based access and an explicit access setting, which takes precedence?

If a user has both group-based access and an explicit access setting, which takes precedence?

• A. The user's explicitly set access overrides the group access setting.
• B. Group access overrides the explicit setting.
• C. Final access is the most restrictive between the two.
• D. Access is determined by the administrator.

Answer: (A)

Explicit access for a user overrides permissions inherited from groups. When an individual has an explicit setting, that specific permission governs their final access, even if their group memberships grant different rights. This allows exceptions for one person without changing the group policy. For example, if a user belongs to a group with edit rights but you explicitly deny edit to that user, the explicit denial applies. Conversely, an explicit grant can elevate beyond the group’s grant. Administrators can configure both, but the explicit user setting takes precedence.

Explicit access for a user overrides permissions inherited from groups. When an individual has an explicit setting, that specific permission governs their final access, even if their group memberships grant different rights. This allows exceptions for one person without changing the group policy. For example, if a user belongs to a group with edit rights but you explicitly deny edit to that user, the explicit denial applies. Conversely, an explicit grant can elevate beyond the group’s grant. Administrators can configure both, but the explicit user setting takes precedence.