I've been assigned the task of building a new SharePoint site for the State of Maine Information Security Office. There are several subsites, each assigned to a different department. One of the supervisors wants their staff to be able to Edit any documents they add to the Doc Library, but to have only Read permissions to the other Documents in the Library. Is there a way to do that without me going in and setting Permissions on each document when they are added?
There is a definite "Maybe".
In a general List (not in Libraries), if you go to the List Settings, and choose "Versioning Settings", you can set exactly what you want in the user interface (see screenshot):
Unfortunately, if you navigate to the same "Versioning Settings" page in the settings for your document Library, you will see that those options are not available.
However, despite not being available in the Settings user interface, those settings are available to be set via script. I can validate that this script runs without errors, but I do not have a quick or easy way to check with other users to see whether it works as intended on a Library.
Using PnP-PowerShell, you can run the following commands on your library to see if it works for Document Libraries:
Connect-PnPOnline -Url https://yoursite.sharepoint.com -UseWebLogin $DocLibrary = Get-PnPList -Identity Lists/Requests -Includes ReadSecurity, WriteSecurity $DocLibrary.ReadSecurity = 2 $DocLibrary.WriteSecurity = 2 $DocLibrary.Update() $DocLibrary.context.ExecuteQuery()
I would not advise that you enable document-level granular permissions. This has a tendency to cause significant performance issues, particularly in on-premise environments.
A few years ago, I was working with a large retailer on their migration to SharePoint for their intranet and as an enterprise tool. After an 18 month pilot, they rolled out the new enterprise environment. Within a week, the entire environment slowed to nearly unusable. The cause? Less than 100 documents with individual permissions.
As a best practice, I do not allow permissions below the library or list level in my SharePoint environments.