Permissioning on list based on group

Question

I have list for of items added by users who belongs to one of the 3 departments. I want that user can only see the item added by them. Each department will have an approver who can see all the items added by the user of his department.

Edit: Thanks to the fellow members I was able to filter the users to see only item created by me. The complicated part is I have 3 user groups and each group has one approve which I have maintained in another list

Now I have added an approver column in the main list which I want to be automatically populated based on the user accessing the list( will need to determine the group which user belongs and then determine the approver of that group from the Group Approvers List).

Can anybody help me how I can achieve this or any other approach.

For Approver Filetering, I will add the filter based on the approver column.

Answer 1

If you're in a Custom List, you can go into Advanced Settings and change the Item Level Permissions settings. The options here configure whether your users can see all items, or see just items created by them. You can also set the creation rules here; whether a user can create and edit all items, create items and only be able to edit their own, or not have any create/edit rights.

You could then put your 'approvers' in their own security group with the 'Cancel Checkout' permission so that they can see all items, or even just place them in the approvers group (as long as that group doesn't have permissions elsewhere).

The issue with creating views as David mentioned is that any view is accessible through the URL. Unfortunately, you cannot place permissions on views out of the box.

Hope that helps!

Answer 2

Create a View and give the Filter Section as Created by [Me]. In this way only those items which are created by login user will be visible to them.

For Approver you can create a Separate view with no filters and provide the URL to Approvers. If the approvers are accessing the list via a workflow email, you can always provide the view url in the Email body.

The scenario mentioned is comparatively simpler. You can also go forward with Audience targeting on particular views if you have Approvers in a particular SharePoint group.

Let me know if this answer your doubts.

Answer 3

I apologize if my response doesn't quite meet your needs, but your request is missing some information. Here are the assumptions I am making based on your post:

• "I have a list for of items added by users" - I assume you are working in a document library
• "I want that user can only see the item added by them." - By them, I assume that an uploader can only see the files they uploaded?

This can easily be accomplished by enabling Major\Minor versioning in the library. In the library settings, click on Versioning settings. Select "Create major and minor (draft) versions)" and enter the number of major versions that will be allowed if require that. To limit the document viewing to the uploader and the approvers you have to select Yes for "Require content approval for submitted items" and then select Only users who can approve items (and the author of the item) under Draft Item Security.

From there you will need to ensure users have the ability to approve items within your library. The library will now allow users to upload documents, but until an approver makes it a major version only the approvers and the uploader can see the file.

If you require department separation for the approvers, you will have to separate each department by either folder or library. You can then set the necessary security on the folder or library so each approver is unique to their department.

You can learn more about creating permission levels here: https://technet.microsoft.com/en-ca/library/cc263239.aspx

You can learn how to add permissions to a folder or library here: https://support.office.com/en-ca/article/Manage-permissions-for-a-list-library-folder-document-or-list-item-9d13e7df-a770-4646-91ab-e3c117fcef45

Please note: AnkitKumar's solution does require less work, but is not totally secure. It is known as security through obscurity. In other words you are hoping that if they don't see the document they won't modify it. However, users can change the view they are using or create a personal view (unless you lock that down) that will then allow them to view and edit the documents.

Answer 4

One option that probably does meet your need is to create a workflow to set item lever permissions. I'm not very sure, but you might even be able to set the permission based on lookups from another list: http://spcycle.blogspot.nl/2012/01/how-to-create-workflow-to-change-item.html

This would be a totally secure method, however using item level permissions is not considered a very good practice, as it can become unmanageable in the future.