I have always had to apply them to the child folders. Usually, now, I use a custom action to do an ACL change on the directory in question and just apply propigation from there.
When using the MSI permissions, remember is a replace, not an add, so if you don't apply all the groups/users that you need, it might not be correct.
Good luck