I need to change the permissions of a document after the approval status has changed. I've to add the new user group to current document if the document has been approved.

I have used following links to achieve the goal:

  • All the links you have shared suggest it is possible. Have you tried?
    – Submits
    Commented Aug 27, 2015 at 10:52
  • Yes, I'd follow the steps, but unable to do a single task of break role permissions for office 365. Can you suggest for the same with Designer workflow 2013 and REST API approach ?
    – Ram
    Commented Aug 27, 2015 at 11:11
  • Breaking permission inheritance with the REST API as described in your first link works - I've just tried it for myself. So can't you just use the Call HTTP Web Service workflow activity with the appropriate REST URL endpoint?
    – Submits
    Commented Aug 27, 2015 at 12:33
  • Did you used in the Designer workflow 2013 for SharePoint online (Office-365) ?
    – Ram
    Commented Aug 27, 2015 at 14:37
  • No I used a Chrome browser plugin called Postman to send the request to SharePoint. Postman is useful to test REST API web service calls.
    – Submits
    Commented Aug 27, 2015 at 14:39

4 Answers 4


In your comments you say you have made an attempt but can't break permissions inheritance in your workflow.

The answer to your question is yes, you can break permissions inheritance via the REST API from your SharePoint Designer workflow.

You will need to use the "Call HTTP Web Service" activity in your workflow and your URL will look like:

https://your_sp_site.sharepoint.com/_api/web/GetFileByServerRelativeUrl('<file relative url>')/ListItemAllFields/breakroleinheritance(true)

If you need help using the Call HTTP Web Service workflow activity you can find various guides like here, here, here, here and here.

Once you have broken permissions inheritance you can then assign your group to the document via the REST API using the AddRoleAssignment method. Again, you will need to use the "Call HTTP Web Service" workflow activity and your URL will look like:

https://your_sp_site.sharepoint.com/_api/web/GetFileByServerRelativeUrl('<file relative url>')/ListItemAllFields/roleassignments/addroleassignment(principalid=<groupId>,roledefid=<targetRoleDefinitionId>)

The first link you posted has good information. You can also find an excellent answer with examples for a similar question on this site here:

Manage File permissions using REST API

  • Hello Submits, Thanks for your valuable response for the post.
    – Ram
    Commented Aug 31, 2015 at 10:44
  • This one can explain in details.
    – Ram
    Commented Aug 18, 2016 at 5:12

I'd finished this task with SharePoint 2010 Designer workflow without REST API. Click here for Link

final URL : Click here for the full article which can explain in details


I want to share my opinion if you want to use SharePoint Designer, a good option would be to have a look at Plumsail Actions Pack. This is a set of more that hundred workflow actions which could be very useful. As for your case you could use Permission Management section, it contains the whole specter of the actions for work with permissions.

P.S.: I'm working for Plumsail and I'm very happy to contribute to the product because I like it :)

  • Firstly Thanks, I got answer which is marked and very useful. Plumsail Actions Pack is free or paid? Because it's an product so it could not be free as I think. I am looking for the solution which is free of cost so that anyone can afford.
    – Ram
    Commented Nov 8, 2016 at 4:27
  • Yes, this is a paid solution, but I know how many time (and nerve cells:) ) it can save for anyone who designs workflows in SPD.
    – Roman
    Commented Nov 8, 2016 at 8:47

I did a quite research finding below things regarding roleassignment. No specific post for these. It might help someone.

Adding to above all replies, I have not seen few things, like -

  1. How to remove roleassignment
  2. Restore the inheritance.
  • Remove roleassignment : _api/web/GetFolderByServerRelativeUrl('')/ListItemAllFields/roleAssignments/removeroleassignment()
  • Restore the inheritance : _api/web/GetFolderByServerRelativeUrl('')/ListItemAllFields/ResetRoleInheritance()

The same thing you can use it in Power Automate as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.