I am working on a SharePoint online site collection. We have a list which can only be viewed by certain users. But inside our workflow we want to be able to add items in this list and to be able to do this, I need to run the workflow on elevated privileges. So I followed the steps mentioned on this link https://blog.devoworx.net/2016/01/31/unauthorized-http-workflow-how-to-create-a-workflow-with-elevated-permissions-by-using-the-sharepoint-2013-workflow/, which are:
Enable the "Activate Workflows can use app permissions" feature.
I copied the app id from "Site Settings >Below Users and Permissions > Click on Site App Permissions".
Then I navigated to
I pasted the app id, clicked on lookup >> I got the app details.
Then inside the "APP Permissions Request XML", I typed the following:
- I created a workflow and added my actions inside "App Step", as follow:
and my workflow was able to add items under the restricted list.
But I am not sure if allowing the workflow to run on elevated privileges (enable it to use app permissions), can pose a security hole inside our sites?
For example: Can non-admin users benefit from this ability to perform actions they aren't authorized to do? or the steps I followed are fine from a security point of view?