1

I am working on a SharePoint online site collection. We have a list which can only be viewed by certain users. But inside our workflow we want to be able to add items in this list and to be able to do this, I need to run the workflow on elevated privileges. So I followed the steps mentioned on this link https://blog.devoworx.net/2016/01/31/unauthorized-http-workflow-how-to-create-a-workflow-with-elevated-permissions-by-using-the-sharepoint-2013-workflow/, which are:

  1. Enable the "Activate Workflows can use app permissions" feature.

  2. I copied the app id from "Site Settings >Below Users and Permissions > Click on Site App Permissions".

  3. Then I navigated to http://hostname/_layouts/15/appinv.aspx.

  4. I pasted the app id, clicked on lookup >> I got the app details.

  5. Then inside the "APP Permissions Request XML", I typed the following:

  1. I created a workflow and added my actions inside "App Step", as follow:

enter image description here

and my workflow was able to add items under the restricted list.

But I am not sure if allowing the workflow to run on elevated privileges (enable it to use app permissions), can pose a security hole inside our sites?

For example: Can non-admin users benefit from this ability to perform actions they aren't authorized to do? or the steps I followed are fine from a security point of view?

Improve this question
3
  • 4
    Generally, I would say that using App Step doesn't pose any security holes, but while designing your workflow you just have to keep in mind, that this piece of code will be executed with elevated privileges (as you already know). So be careful with actions like "delete item" or calling rest API. One more thing that comes to my mind is that if you enable "App Step", then all users from the "Designers" group and above will be able to use it in their workflows. So be sure that site groups and permissions are correctly configured.
    – Dennis
    Commented Oct 27, 2018 at 5:01
  • 1
    @Dennis thanks a lot for sharing this clear and correct answer, it would be great to add it in the answer sections. >> to The OP (SharePoint TestDev) please don't forget to upvote and accept the helpful and correct answers to close the question !!!
    – Mohamed El-Qassas MVP ♦
    Commented Oct 27, 2018 at 14:54
  • @Dennis thanks for the clear reply. now i am not allowing any user to get the Design permission level and only certain users (authorized users) have full control permission.. but can this feature be used by other components inside Office 365 such as PowerApps, Flow or other components outside SharePoint workflows? so users can indirectly benefit from this feature to perform actions they are not authorized to do ?
    – John John
    Commented Oct 28, 2018 at 0:24

1 Answer 1

Reset to default
3

Allowing the workflow to run on elevated privileges (enable it to use app permissions), doesn't pose any security holes in SharePoint.

Following are the points you should know before using the App step in workflow:

  1. The one drawback of using an Impersonation Step is that the workflow could suddenly stop working if anything were to happen to the user account that created and published the workflow.

  2. The purpose of the Impersonation Step is to run any actions inside this step as the user who authored the workflow. If the account that creates and publishes the workflow is edited in some way, possibly with a permission change on the site or a password change, then you have a broken workflow!

  3. I know App Step provides facility to run SharePoint Designer activity under Service Account user. But by enabling the app step, you can see that user who does not have permission on sub-site, can perform any operations(even deletion) on the sub-site by creating the SharePoint Designer workflow on the root web once the workflow app identifier is configured.

  4. Users with "design" and "full control" permission on site can create designer workflows and use the app step inside their workflow. So manage the permissions on site accordingly.

Improve this answer
7
  • now i created the workflow using the admin account. and this account is the global admin for our tenant. but the "App Step" will not run under this account, for example if i am creating a item inside the App step, then the createdby will be equal to "SharePoint App" username, and not to the admin username. second point, now as i know to be able to create a workflow in sharepoint, the user need to have Design permission level, and currently we are not granting any user this permission.
    – John John
    Commented Oct 30, 2018 at 14:16
  • also i think uers with Design permsion can already configure the workflow to run with elevated privisliges.. is this correct? as a conclusion if i am not allow end users to have Design permissions >> then this means end users can not create workflows >> and as a result my "App Step" inside the workflow should not pose any security hole, and this can not be used by other components inside our office 365 such as flow or powerapps??
    – John John
    Commented Oct 30, 2018 at 14:17
  • Added 4th point in the answer, users with design and full control permission can use the app step in their workflow.
    – Ganesh Sanap - MVP
    Commented Oct 30, 2018 at 14:47
  • 1
    Yes, you are right. Also, please accept the answer if it answered your question. So that other users can benefit from accepted answer.
    – Ganesh Sanap - MVP
    Commented Oct 30, 2018 at 14:52
  • 1
    No, will not affect anything in flow.
    – Ganesh Sanap - MVP
    Commented Oct 31, 2018 at 11:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.