I'm trying to restrict a user account to only be able to read and access a document library. The account is supposed to access this through the CSOM - is it even possible to do this?

It seems like the clientContext NEEDS a Web url - which means the user account would require permissions for the parent web of the document library - correct?

1 Answer 1


Correct, you would need to allow access to the specific site that library lives on. Then give access to the library. You can't elevate CSOM permission; that would be huge security problems.

If you have information on the parent site that is sensitive, you can create separate permission groups and restrict access to what the account(s) can access. But...that may be a logistical headache depending on the permissions you need to grant/restrict.

Try creating a separate site with unique permission for that individual account. Then creating a library that will inherit your unique permissions.

  • Thank you (although, I don't know what you mean by elevating? I'm trying to do the opposite of elevating). I guess it can't be done at all, only granting permissions to a list/library. Do you by chance know if the same is true for the REST api?
    – Dynde
    Sep 26, 2017 at 5:41
  • Well, what I mean by elevate is that you would have to override the local sites permissions on behalf of the user who does NOT have access to the parent site. So if you only want to allow access to the library, but not the site, the code-behind would still need to start on the site level. Then work its way down to the library. So you would need to elevate the permissions of the code to access the site behind the scenes. The user would not have direct access to the site with that code....if that makes sense.
    – Marion O
    Sep 29, 2017 at 11:57
  • As for the REST Api access, yes, you will still need authorization to the resource/library based on the users credentials.
    – Marion O
    Sep 29, 2017 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.