On SharePoint Online I have a 2010 workflow with an Impersonation Step to Replace permissions of the current item so only the person who created it and also the Administrator for the corresponding region can see it.

Presently the Administrator is hard-coded in the workflow.

The Region is choice column on the list.

Whenever a regional Admin changes (or additional ones are added), the workflow will need to be adjusted so the permissions are adjusted (person removed or new ones added).

My question is: How would I use a Lookup list with Region and the corresponding Admin so the workflow can look at that? This will be a better interface, so the admin team can change admin roles from a list rather than having IT to change the workflow each time.



SharePoint group needs to be created to represent each region. You do not need to change admins anymore. For example:

Region 1- SPGroup-Region1-admins -> Members in SharePoint Groups(John Smith, ..) Region 2- SPGroup-Region2-admins -> Members in SharePoint Groups( Jane Smith, ...)

You can update users in the SharePoint Groups without affecting any workflows.

To implement this solution, You also need to update workflows and replace users with their corresponding SharePoint Group once.

  • Hi David - thanks for that. I did think about using groups. This is quite a good user interface & something I may consider. However, ideally I'd like to use a list. This has the benefit of being easier to control in terms of permissions, so only a limited amount of people can edit it. In my experience managing access on permission groups is a lot let clear cut and not as easy to manage than a list would be. I've got something working with a list. Attached is a screenshot of what I've put in place (maybe useful for others to see, if they stumble across this thread in the future) – Albini's cat Dec 2 at 9:22
  • I'm getting errors if the 'People' field is blank. I may be able to fix this by setting a guaranteed value returned (for instance CreatedBy) at the top of the 'Replace List Item Permissions' box. I think they run sequentially, top-down. Yet the Workflow may still error if the value is empty. An easy way around this is having a required value in there. – Albini's cat Dec 2 at 9:26
  • You don't appear to be able to use a 'multiple' people field to do this (see second screenshot). *can't figure out how to add images to new posts! If I had multiple people in a plain text column - what's best to extract the values to pass to a variable to the replace permissions? I see the string returns something like '799;#' before the name, so I'd need to 'clean up' what's being returned. Thanks again. – Albini's cat Dec 2 at 9:26
  • I would not use the SharePoint list to set item permission while some users can edit that list. This solution is not scalable and creates a security issue. for example, if the list has incorrect information such as username, SharePoint is trying to set permission for the user that it does not exist and the workflow will fail and the item can become available to everyone. if you remove the user from SharePoint the item cannot be accessed by the new user that belongs to the same region That's why we user SharePoint groups. In other words, you set permission to groups, not users! – David Dec 2 at 13:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.