User permissions by metadata?

Question

I'm trying to set up a site architecture for a new Office 365 account, and we would need to have a site and its documents generally open to multiple employees, but some of these need access to most documents but not all.

I was wondering if this could be controlled by metadata? I.e. if the site and document library is generally open to all users, but if a file or page has a certain metadata value, it should be restricted to a particular group. Is that possible? If not, is there another way to achieve this?

Answer 1

I wouldn't use metadata to do a workaround on permission when you already have item level permission built in. By default your documents inherit site permission and those with sufficient permission can read, update and delete documents. But if you want specific permission on a document, edit sharing the following way.

Select Shared With

Click Advanced

Click Stop Inheriting Permission in the ribbon.

Select the groups that shouldn't have permission to this document. In our case, all groups but the Owners group. Then click the Remove User Permission button in the ribbon.

When done, you now see that only the Owners group have permission to this document.

Back on the document library, you only have to fire up the menu to see who this document is shared with.

Answer 2

I would suggest creating separate document libraries with required permissions and move the documents from main document library through workflow. Workflow can use the tags attached to a document for making the decision of where to publish.

Answer 3

I was also looking for some options along the same lines but obviously individual permission is the only solution available.

Another workaround - the way I designed the site was based term store navigation and then a sub-site for each term-set. Once we have achieve this we can set up the rules to move the documents to the individual site's document libraries.

Thanks SP

Answer 4

Use different libraries. The more you try and hack around the more trouble you will get into.

Answer 5

You can put the restricted documents in a specific folder and change the view from folder view to flat. In that way only people with permissions to the folder will see the documents that are restricted.

Answer 6

I had a similar issue where I wanted certain users to see certain parts of a library on a home page. I ended up making a security group that matched with an associated view for each part of metadata I wanted to sort by. I then made multiple library web parts with the selected view and audience set to the metadata I wanted to sort by.

Each web part is only visible to the sharepoint group set in the audience and they have the view that applies to that sharepoint group. If they click into the library, the view holds.

If it's important that they not be able to access other views, there is a workaround here, but it involves using sharepoint designer.

Answer 7

It's possible in M365. I created this for a customer using managed metadata.... Each managed metadata tag was mapped to an Azure AD group (using a SharePoint custom configuration list). Using a PowerAutomate flow the permissions could be set by looking up the documents tag and then identify the Azure AD group that should be added with permissions.

It took some flow development with some triggers and some SP Web API calls though.