Sharepoint Online: item level permission on Document Library

Question

For our SharepointOnline website we'd like to set item level permissions on a document library. The goal is that the user can:

• view all the documents in the library
• create (and upload) new documents
• edit their own documents
• no delete permission (only an administrator will be allowed to delete documents)

We cannot set item level permissions on document libraries through the UI but it is possible by using PowerShell. This is for on premise Sharepoint. Source: https://sharepoint.stackexchange.com/a/162308/70734

We want to be able to do this for our Sharepoint Online solution. An update to CSOM made it so we can manipulate the ReadSecurity and WriteSecurity properties on lists. Source: https://sharepoint.uservoice.com/forums/329220-sharepoint-dev-platform/suggestions/15147063-implement-rest-csom-api-method-for-setting-list-re

---

Initial situation:

Updating ReadSecurity:

var expectedReadSecurity = 1;
clientcontext.Load(list, x => x.ReadSecurity, x => x.WriteSecurity);
clientcontext.ExecuteQuery();
Console.WriteLine($"List: {list.Title} - ReadSecurity {list.ReadSecurity} - WriteSecurity: {list.WriteSecurity}");
if (list.ReadSecurity != expectedReadSecurity)
{
    list.ReadSecurity = expectedReadSecurity;
    list.Update();
    clientcontext.Load(list, x => x.ReadSecurity, x => x.WriteSecurity);
    clientcontext.ExecuteQuery();
    Console.WriteLine($"List: {list.Title} - ReadSecurity {list.ReadSecurity} - WriteSecurity: {list.WriteSecurity}");
}

Output:

List: Reference documents - ReadSecurity 1 - WriteSecurity: 1
List: Reference documents - ReadSecurity 2 - WriteSecurity: 1

Result:

---

Updating WriteSecurity:

var expectedWriteSecurity = 2;
clientcontext.Load(list, x => x.ReadSecurity, x => x.WriteSecurity);
clientcontext.ExecuteQuery();
Console.WriteLine($"List: {list.Title} - ReadSecurity {list.ReadSecurity} - WriteSecurity: {list.WriteSecurity}");
if (list.WriteSecurity != expectedWriteSecurity)
{
    list.WriteSecurity = expectedWriteSecurity;
    list.Update();
    clientcontext.Load(list, x => x.ReadSecurity, x => x.WriteSecurity);
    clientcontext.ExecuteQuery();
    Console.WriteLine($"List: {list.Title} - ReadSecurity {list.ReadSecurity} - WriteSecurity: {list.WriteSecurity}");
}

Output:

List: Reference documents - ReadSecurity 1 - WriteSecurity: 1
List: Reference documents - ReadSecurity 1 - WriteSecurity: 2

Result:
Obviously, the document library still shows all the files. However, our user can edit all the files in the document library, not just his own ones (we are logged in with the green user). You can see that the 3rd document, created by BLUE can be edited by GREEN.

---

Question:

It seems the ReadSecurity in CSOM is correctly implemented and is doing as expected. However, the WriteSecurity property is not working as expected. Is this an oversight? Are we missing something here? A ticket was created to the Office365 team, but unfortunately they were unable to assist us in the issue.

Answer 1

Your referencing something that only exists in a list, it doesn't exist in document library:

WriteSecurity

https://msdn.microsoft.com/en-us/library/microsoft.sharepoint.splist.writesecurity.aspx

this was valid for 2010/2013 but not for 365! you need to either have a custom app or be creative and create a workflow that assigns read only to the document. Its got some functionality due to document library is a type of list.

having fine grained permissions is not recommended and should only be done if necessary or as a custom solution