0

I have the following requirements regarding permisisons which so far couldn't find a good solution for. Appreciate your thoughts and experience.

When adding/editing an item and based on its metadata, specific users(s) shall have access as edit, others as view and the rest none. The issue is that assigning the permissions is a bit difficult. The user can be assigned to view the requests that are submitted by a specific country. Also he might be able to view the requests that are submitted by a specific company and even both. User X can view Country A. User Y can view Company B (that might exist in Country A and Country C) User Z can view country A and Company B -> only requests submitted from Country A from the Company B

This is just a subset of data and it prolongates to additional 5 columns (Departments, Business Unit, Cost Center, etc...)

What is the best way to manage such kind of permisisons given that it should be easily managed with the ability to have instantanuous changes where adding a user for Company A will directly provide him access to all previous submitted requests.

An option would be having a list where users are added with the differnt assigned data as coulumn and automatically adding them to the related SharePoint groups that follow a specific pattern. Access shall be granted to these groups. The issue is that I foresee a huge amount of SharePoint groups that shall be created: (Role_Country_Company_BusinessUnit_Department_CostCenter) and all the individual combinations (Role_Country, Role_Compnay, Role_CostCenter and ROle_Country_Company) etc...

Application enviornment is SharePoint online and SharePoint 2016 On-Premise (due to data privacy requirements for some countries).

Appreciate your input.

Thanks, Zeina

|improve this question
0

I dealt with a similar problem and it comes down to 2 issues: If you are willing to create a workflow with multiple if...else clauses AND if the site owners are willing to maintain the several sharepoint security groups that you will need to create.

In my case I had 4 areas and 7 sectors, which means it is already 28 if...else combinations

The workflow is a sharepoint 2010 one with impersonation step (not sure if this is possible with flow)

if it is Area 1 and Sector 1, replace permissions with Area 1 read, Sector 1 Read

else

if it is Area 1 and Sector 2, replace permissions with Area 1, read, sector 2 read

etc etc for 28 times

You understand that if you have a third multiplicator, or a fourth or a fifth, it does become cumbersome.

To try to ease up, if the contributor is a single person instead of a group, you could write it in the item as 'assignee' in the list item or some other word so that the workflow can take that as a value.

The other must is that the site owner takes care of putting the right people in Area 1, Sector 1 etc etc. and keep them updated, otherwise everything falls apart.

|improve this answer
  • Thank you for your reply. Maintaining the SharePoint groups is an easy on as an event handler on the list where users are added to will add/remove users accoridngly and create the groups automatically based on specific pattern. Issue remains in the workflow. As there will be a custom form, I am not sure if managing the permissions (changing them to edit/read) in the form itself is appropriate? – Zeina May 15 at 9:14
  • If some people or some groups change their permission throughout a time span it can be handled with a workflow provided there is a trigger. In my case the form remained the same for all users regardless if they were readers or editors. I know infopath can handle different forms based on users but it has limitations and very long to build. Not sure if PowerApps is better/up to the task. – susan May 15 at 10:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.