SharePoint Users Can’t Access That, Right?

The other day a customer was locking down a site collection but discovered that no matter what she did, all users in the entire organization still had read access. This, in a word, was troubling. Could it be that SharePoint has a giant gaping security flaw? Fortunately, this was just one of those cases when a nonintuitive feature feels like a bug.