User Default Profiles

In a single-site implementation, you only need to set the default profile for each user. This will be their profile for the entire system.
In a multi-site implementation, a user’s default profile determines their level of security for all of the sites that do not have a specific security profile selected. For example, if a user’s default profile is set to Read-only access, the user will have Read-only access to all objects in all sites, except for sites that have a different security profile specified. For example, you might use a more restrictive security profile as the default, and set specific site profiles for a user’s home site, your top site, and any other sites that need greater access.
If a user does not have a default security profile, they might have access more to actions or data than is intended. For example, if you assign a site-specific profile to the user’s home site, and do not set up any other site security or select a default profile, that user will have full access to data at all other sites in the enterprise.
Note: A user that does not have a default security profile and does not have any site security profiles will have full access to the entire system.