I would like to know if there's a way to upload a file and based on a user selection from a drop down, set the permissions automaticly with those permissions? Is it possible to do this oob or with sp designer?

For example having two choices, default and restricted. And when user let's the default option the permissions stays as set by default for the document library, but when selecting restricted, the document permissions would be set to restricted group.


  • You can achieve this by using a sharepoint 2010 workflow. Add impersonation step to the workflow. Inside the impersonation step you will have actions like "Assign Permissions", "Replace Permissions" etc. Use the replace permissions action to do the necessary permission changes based on the metadata values of the document/file. – Suresh Kumar Senapati Feb 18 '16 at 10:45
  • Good Day Dears, Thanks All for above solutions, but let me elaborate more on the above question was raised by J.Doe , but the main pain we have that we require to set AD group permeation on the document level based on one or more document SP document property selected, (i.e) user has filled the document property named 'Dept involvement'Choice Checkboxes (allow multiple selections) (IT, HR etc.), the AD group will set into document are as below if the user selected HR property the group will inherit to the document permeation as below: 1. DMS_HR_Admin 2. DMS_HR_Managers if the user selected – Alaa Balbisi Jun 6 '18 at 11:34

Document level permission management is a pain in the patoot.

Instead of assigning permissions to an individual document, consider just setting a flag on a document column.

Then create site pages for each "permission level". Filter the library view to show just the documents that apply to that level.

Serve your users the site page instead of letting them navigate to the library view.

  • 2
    That would create security issues. A. Documents would show in the search. B. Users could open the library with WebDav interface and access the restricted documents. – Marek Sarad Feb 18 '16 at 9:17

I must agree with what @teylyn wrote in her answer. Setting item level permissions is not the best idea. But using filtered views on pages instead of setting permissions may not be enough to prevent users from accessing the files.

You can create 2 folders in document library:

  • Default - all users have contribute rights to the folder
  • Restricted - all users have custom permission level (only allows to add items), Restricted group has contribute rights.
  • Set read-only permissions on library level (to force users to create documents in one of the folders).

It should be enough from security perspective and is manageable.

You can create flat view (select 'Show all items without folders' in 'Folders' group on 'Create view' page) to show all items without folder structure.

You can also use Content Organizer to move documents to one of those folders based on column value.


So to answer, yes it is possible. In the library specify metadata (permission level) and then create WF with designer to trigger automatically upon upload and set the permission based on that metadata. There are certain caveats to that approach. A. If you will have a lot of items uniquely secured it can cause performance issues or block you from accessing content completely (check out issues with list view thresholds and row wrapping when you have a lot of metadata)

A way to mitigate it would be to route the document between different libraries that have same root permissions. So documents inside wouldn't have unique permissions. You can do it with WF or Content Organiser.

  • Just one comment to the answer. You need to remember that my example the document of a brief moment will be available to other users. For some security situation this it not acceptable and document from the outset needs to have specific permissions, in that case you would have to go and create custom event handler to set permissions on the document upload/creation. – Marek Sarad Feb 18 '16 at 9:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.