3

I'm tasked with both locking down and giving users access to an old HR site.
There are some lists and a couple of document libraries (~500 items in largest list/library, in the span of some years).

Every item has a field for which employee it is connected to.

  • HR administrators should see all items.
  • Department managers should see all items of employees in the same department.
  • Users should see their own items.

I'm thinking about programmatically setting item permissions, as performance for so few items shouldn't be a problem (technically; pnp + Azure Functions + list subscription).

But is there any way I could lock the lists down, so by default only site administrators would see new items?
- I tried item-level permissions (advanced list settings), but then I'm not able to show the items to department managers. I'm going to break inheritance of every single item, I see not other possibility, so then this problem will be solved anyway, but the main problem is that new items will be visible for everyone until my code has fixed the item permissions. Also; are there any alternative approaches (OOTB) I could use instead?

Improve this question
4
  • If it is an old site, why are new items being added to it. I would cut-off new items being added in there - can't you create a new HR site and set up the lists & document libraries there? Then you can manage the security from there. It would also simply security in the old HR site too. I wouldn't recommend using item-level security, it's too difficult to manage in this way. Instead manage permissions using SP groups - it sounds like a read-only (View) group would be suitable in most instances.
    – Tally
    Jul 25, 2018 at 9:32
  • @Tally old site which is still in use, I specified old to imply I'm going to add permissions to an existing site, there are no intensives to create a new one. Currently only HR administrators have access. I'm not sure how SP groups will help me solve the problem, as I still need fine-grained permissions to allow users to see only the items they are connected to.
    – eirikb
    Jul 25, 2018 at 9:48
  • Hmmm, I see. Perhaps there is a way to filter out new items so that they are not visible to users - e.g. if Created Date is greater than date x, do not display it. I'm not sure if this is a good suggestion, but perhaps you could use 'cascading columns' to limit which documents should be visible to which departmental manager (your 2nd bullet point); either by tagging documents or else using the 'Created By' field. However, if people have changed department this would be complicated... Otherwise could a Content Query Web Part be used somehow? Sorry I can't suggest something more concrete...
    – Tally
    Jul 25, 2018 at 9:57
  • @Tally It's important that items can't be reached by users, not only directly in the list, but REST and JSOM as well.
    – eirikb
    Jul 25, 2018 at 10:28

1 Answer 1

Reset to default
1

You could try adding a new Permission Level with ViewFormPages and AddListItems as default permissons since you have to manage the perms pr item anyway afterwards. 

Add-PnPRoleDefinition -RoleName "AddOnly" -Include ViewFormPages, AddListItems
Improve this answer
2
  • Nice one Anders, always good to hear from you. I tried doing this in the GUI, but it wouldn't let me, didn't think about doing it programmatically.
    – eirikb
    Jul 25, 2018 at 10:53
  • Yeah, kinda annoying it forces ViewListItems in the GUI, guess it's for avoiding support calls hehe
    – Anders Aune
    Jul 25, 2018 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.