5

In SharePoint online, we wanted to give certain users permissions to only view document properties, but not able to view the document file itself or download it. From what I know it is not possible in SharePoint. Has anyone found a workaround for such a requirement?

Improve this question

3 Answers 3

Reset to default
4

Permission Levels do not allow this functionality on a single document item (i.e Open Item vs View Item would be the closest )

You can certainly obfuscate and hide, but if this is sensitive data then this approach is critically flawed. There are many ways of circumventing (Rest API,Search,Direct download links,Object Model plus a heap of others)

The only way this requirement can be achieved is by splitting the document and metadata into different lists/libraries (the lowest possible permission junction in this case).

You could have a presentation library with open permissions that contains the metadata including a link to the actual document, as long as this document is stored in a library that is locked down. How the two are linked and displayed is fairly flexible (ie Workflow, Custom page to view items).

Improve this answer
1
  • Thanks James, that is what I have been thinking, to separate the entities and permission them based on requirements. I thought about connecting the list to the library with a lookup field. This though will make the data entry hard OOTB, which begs for a custom page.
    – Paiman Samadian
    Commented Jul 16, 2018 at 0:57
4

To answer your initial question, it is not possible OOTB.

You could achieve this in a different way, though:

Create 2 libraries - One to have the original library with all the documents, where all permissions are restricted and another to have the document property columns but here with no access restrictions.

Whenever a document in the root library is modified, a simple workflow copies over the property values to the second library.

Improve this answer
2
  • Thanks Deepu, nice answer +1, although I am not a fan of duplicating any data/syncing scenarios. Workflow failure will mean unsynced data and more hassle.
    – Paiman Samadian
    Commented Jul 16, 2018 at 1:03
  • No worries Paiman. It was just a thought. All the best.
    – Deepu Nair
    Commented Jul 16, 2018 at 13:17
1

WARNING This solution still allows access to the documents via any other way (REST,Search,CSOM,WebDav) It only hides the links and should not be used to secure documents... (Edit by Heiko Hatzfeld)

Yes, It is possible OOTB for SP Classic Mode. Although If a user needs to see the document properties, he/she must have access to the document (Just a logical, typical SharePoint way :) ). But what you can do is you can hide the document from opening/downloading at List view level. This workaround goes like this :

Prerequisite:

  1. A SharePoint Group with people whom you want to give only Meta-data access.

  2. Site admin credentials.

Your Answer: Create a new list view say- meta-view.aspx and Use Target audience on this. Also don't forget to remove their access in AllItems.aspx view.

You can easily do so by Editing the Page where documents are shown and edit the list view web part property -> under advanced, got to Target audience and select the SP group (as per the prerequisite) --> Click OK Then Change the list view fields and include "Name(for use in the form)" . This will not have editLink--> click Okay

Note: Make sure you remove the access of these people from default AllItems.aspx. Otherwise they can view/download files also. Refer SS: enter image description here

enter image description here

Improve this answer
9
  • just trying to understand your answer. When you say "don't forget to remove their access in AllItems.aspx view" , how exactly would you remove access from a view in SharePoint?
    – Deepu Nair
    Commented Jul 13, 2018 at 6:42
  • using Target audience only. So, All items.aspx can have all other groups apart from this prerequisite group. Did I answer your query?
    – DvG
    Commented Jul 13, 2018 at 6:54
  • not quite. So what you mean is that AllItems.aspx is a view in a different page where the target audience needs to be set by editing the page. But what if the end user has a direct link to the .aspx page itself. And thinking about all the possibilities, what if the above scenario is in a SharePoint online modern page.
    – Deepu Nair
    Commented Jul 13, 2018 at 7:03
  • Hi Deepu, Point1. AllItems.aspx is the default link (landing page) available when you click on a library. I am asking set target audience at this level too. it is simple understanding like GroupA has access to meta-view but not the allItems view. It is worth noting that i am not talking about page level access, I am talking only to audience level. Please refer my screens. Point2. regrading modern view, target audience is not available yet. but a requested feature by user voice. So, Yes this solution is a workaround for Classic Mode only.. As of now... Thanks.. does this make sense?
    – DvG
    Commented Jul 13, 2018 at 7:27
  • 2
    This is a very BAD solution. You are using security by obscurity. The user still can access the document: Via Search, via REST, via CSOM, via Explorer, via Links... Audiences is -NOT- a security feature!!! It is only there to prevent information overload and hide stuff you usually don't need. Hide is not preventing access... it only prevents some links to be displayed. (Sorry, I am picky about security)
    – Heiko Hatzfeld_MSFT
    Commented Jul 13, 2018 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.