1

What I am trying to do is remove access to all groups and users but make the user that triggered the flow the owner and be the only one with access to that document.

Is this possible without using any external tools? I haven't found anything within flow that allows me to play with file permissions/access.

0

This can be done with a few SharePoint Http requests to the REST api. The first one to break the document's permission inheritance, another one to get the current user's ID from the SharePoint user list and the last one to set the permissions.

The library title is in the variable myLibrary, the document ID is in the variable myDocumentID. Create a SharePoint HTTP request, select the site and set the method to POST. The URI will then look like this

_api/lists/getByTitle('@{variables('myLibrary')}')/items(@{variables('myDocumentID')})/breakroleinheritance(copyRoleAssignments=false,clearSubscopes=true)

Next, get the ID of the user that you want to assign permissions to. If this is run on a document library when a file is uploaded, you can get the user details from the ModifiedBy field. Use the Email address of that user and store it in the variable UserEmail. Then you can get their ID this way

SharePoint HTTP Request called GetUserFromEmail', specify site, method isGET`, URI is

_api/web/SiteUsers/getByEmail('@{variables('UserEmail')}')

This will return a complex user object. You need the d.ID property. Set the variable CurrentUserID to this expression

=body('GetUserFromEmail')['d']['ID']

Important: if the action to get the user contains spaces, the body() command must use underscores in place of the spaces for this to work.

=body('Action_with_spaces_are_harder_to_work_with')['d']['ID']

Now you can set the item permissions. Add a SharePoint HTTP request, select the site and set the method to POST. The URI is

_api/lists/getByTitle('@{variables('myLibrary')}')/items(@{variables('myDocumentID')})/roleassignments/addroleassignment(principalid=@{variables('CurrentUserID')} ,roledefid=1073741830)

The roledefid for Edit permissions is above. Contribute would be 1073741827. The standard roledefids can be easily found on the web. If you have custom permissions, you can find all permission numbers when you look at the xml returned by this URL.

https://yourtenant.sharepoint.com/sites/yourSite/_api/web/roledefinitions

Let me know how you get on with this.

  • Thank you very much for the response! I will try this in the next few days and let you know if it works. – Sender007 Apr 11 at 15:30
  • Hi teylyn, Thanks again for your response. It seems to work for everything except for the owner and users the document has been shared with manually. Is there a simple way to remove access from those users as well? – Sender007 Apr 12 at 19:50
  • Sorry, can you explain in a bit more detail what is not working? You said you wanted to remove ALL ACCESS to the file, then give access to the current user. Is that not working? If your requirements have changed, please accept this as the answer to your original question and ask a new question with your new requirements. – teylyn Apr 13 at 2:20
  • Hi Teylyn, the requirements have not changed. I do want to remove all access from everyone associated with the document and make the user who triggered the flow the owner. It just seems that when a user has modified access to the document and granted another user access manually, breakroleinheritance doesn't seem to work and no longer removes access from anyone (this could very well be an issue with our configuration). Still that being said it works fine for 90% of my scenarios. Thank you very much! I really appreciate you taking the time to answer my question :) – Sender007 Apr 16 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.