0

I have a list workflow, which is supposed to kick off automatically whenever a list item is edited. The workflow works properly for those users who have got 'contribute' permissions to the list. However, some users have got only edit level permissions to individual list items. When they edit an item, the workflow doesn't start at all. I can see the message 'Access denied. You do not have access to perform this action or access this resource.'

I researched the issue and found that the issue could be related to the permission levels of the user who edited the item.

So I did the following:

  1. Enabled the app permissions for workflow
  2. Enabled full control for workflow app
  3. Enveloped each stage of the workflow in a separate app step

However, the workflow still wouldn't start. The error is exactly the same as before.

To be clear, the workflow doesn't execute even one line of code because the first step is to log a comment in workflow history which doesn't happen.

Any thoughts on how I can get the workflow to start when an item is edited by users who do not have permissions for the whole list?

Many thanks

Improve this question
7
  • 1
    if you are elevating privileges, the script is runing as "system account" and saddly workflows dont run under "system account"
    – Marco
    Dec 27 '17 at 15:35
  • Thanks @Marco.. but isn't the whole point of using a workflow as an app to circumvent issues related to permissions? What have I achieved by doing the 3 steps I listed in my email?
    – KMLN
    Dec 27 '17 at 15:38
  • but isn't the whole point of using a workflow as an app to circumvent issues related to permissions? under certain point, yes that is the idea, but also is not the idea execute code as a farm/tenant admin.
    – Marco
    Dec 27 '17 at 15:47
  • Is there any workaround available?
    – KMLN
    Dec 27 '17 at 20:10
  • first of all, if you add an item manually to your list, the workflow start?
    – Marco
    Dec 27 '17 at 21:06
1

First of you are correct on the whole idea of the elevated permission. What Marco is talking about is only related to starting the workflow under the system account. Even if you add an app step you still initiate the workflow using your logged in credentials - which is perfectly fine!

You could try unticking the "Automatically update the workflow status to the current stage name" - I have found this often prevents the workflow from running for user with limited permissions to the site.

Also you might want to make sure that the workflow history list (Which is hidden and needs to be accessed from the designer) has changed permissions to ensure all users have at least contribute permissions. This will only be an issue if you are logging to the workflow history outside of the app step.

Improve this answer
2
  • thanks. The issue got resolved after I unticked 'automatically update the workflow status ....' The workflow is now working perfectly!
    – KMLN
    Dec 30 '17 at 12:51
  • Glad to hear - it has been the root of a lot of frustration for me as well in the past :)
    – Morten K
    Dec 30 '17 at 17:59
0

Do the users who have only edit permission to an item have permission in the list and site?

Please go to site settings->site collection features, make sure you have deactivate “Limited-access user permission lockdown mode” feature and check again.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.