Set user permissions required to run workflow

Question

How do I set permissions required for users to run/execute a SP2013 workflow?
Somewhere in the MSDN I read "Edit Items" is required to run workflows. Somewhere else I read "Manage Lists" is required to run workflows if they are configured for manual execution.

If you look at a workflow's properties you can see there's a checkbox for "Allow this workflow to be manually started by an authenticated user with Edit Item permissions".
So obviously users with "edit item" can execute a workflow. I guess otherwise it defaults to "Manage List".

Now the question is.. is it for example possible to configure workflows to be executed by read only" users - or site collections admins - too?

Answer 1

I've only dealt with SharePoint 2010 Workflows running in SharePoint 2013, so I don't know whether the following applies to SharePoint 2013 Workflows as well, but I've discovered the following:

• List Workflows: Require Edit permissions to start
• Reusable Workflows: Require Edit permissions to start
• Site Workflows: Able to be started by users with read-only permissions. users with read-only permissions won't be able to view the site workflow at http://site/_layouts/15/workflow.aspx, but if they have a direct link to the workflow (e.g. http://site/_layouts/15/IniWrkflIP.aspx?TemplateID={WorkflowGUID}) then they should be able to start the workflow without any issues.

Answer 2

Simple answer is No.

As you can see the checkboxes in workflow property, you can set the trigger to be

• trigger itself when item added or modified.
• manually start by users.

For readonly user, they are not able to click the "start a workflow" button. Also these user do not have permission to add or modify list item.

You can configure your workflow with "impersonation step". In this way, the workflow will be running under the account of "workflow creator" instead of the user trigger the workflow. However, even you applied "impersonation step", readonly user still not able to trigger workflow.

Answer 3

This is the simple case.

Your workflow do not need any permission to run. It is handled through the App Pool account. Also there is a way that you can force it to run under a different user (which I have heard, have not tried). Unless, its app pool.

But there are some situations where your workflow might need to edit the current item the workflow is attached. If there are such scenarios, you better set permissions immediately before, then do a system update on the list item permission which will affect immediately. Then edit the item and remove permissions with a system update again.

Answer 4

Some background: I have a workflow that is triggered by jQuery code. It pulls the data from one list and moves it to another list. Nothing needs to be updated,edited or changed in the current list. This is why I wanted to prevent the users from editing anything. My workaround was to grant the edit permission for that list, but then update the infopath form to disable all fields. This keeps my list from being updated but allows the end user the ability to run the workflow. Sure they could go into a datasheet view and make updates, small price to pay.