For every project in our organization there is a SharePoint site. The default document library within that site contains all documents pertaining to a project. Some of the files are supposed to be visible only to users within the organization, some to external users that are given access to the SharePoint site.

This is supposed to be regulated through a yes/no column called External. External users are only supposed to see the items where the External column has a value of yes, none of the others.

Just moving the files to an additional document library on the site is not an option, as everything is supposed to be in one library.

I already tried out creating a web part showing the document library with a restricted view on another page with audience targeting only the security group containing the external users, but they can just change the view to any other.

1 Answer 1


Basically you need to break the permission at the item level and add/remove the permission for external users.

It can be done through a powershell script.

Reference: https://www.sharepointdiary.com/2018/04/sharepoint-online-remove-user-group-from-list-permissions-using-powershell.html

If you prefer a non code solution:

  1. Store all your external users in a sharepoint group.

  2. Create a SharePoint designer workflow, which can be started manually as well as on item addition/ modification. In the workflow:

    a) check the value in "External" column.

     if it is yes
       then check if (external group has permission)
          if yes: then do nothing.
          if no: create an app step
        inside the app step
          a) break inheritance on the item
          b) add permissions for external users group
       create an App step(SP 2013 workflow)
        inside the app step
         a) break inheritance on the item
         b) remove permissions for external users group

Reference: https://www.c-sharpcorner.com/article/removing-item-permission-using-sharepoint-workflow-and-rest-api

For existing documents you need to trigger the workflow manually, for newly created documents, it will be automatically triggered.

  • I am fine with code solutions, but I'm not sure if that solves my problem. If an internal user were to set the External column to yes, how would the item receive the permission to be visible to the external users?
    – cescara
    Jul 2, 2020 at 10:43
  • Corrected the answer. But to answer your comment. If an internal user sets the value to yes, the workflow would add the group with all external users (or maybe a security group which contains all external users) and give it read permission on the item. If a person does not have permission, then sharepoint makes sure the items are not visible . This is the default behaviour. Jul 2, 2020 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.