0

I have created a web-part page containing a web-part that reads, updates and deletes items from lists and libraries. I have created a group and linked it to a custom permission level that has the following permissions:

  • Add Items
  • Edit Items
  • Delete Items
  • View Items
  • View Application Pages
  • View Pages
  • Open

I have then added a generic user account to this group. The idea is that anyone using this account can use the web-part page to access/manage the information. This works as designed.

The problem however, is that the user could just as well access Site Contents, or SomeList/AllItems.aspx, SomeLibrary/AllItems.aspx and manipulate the information without having to use the web-part. I would like to restrict this access.

So are there ways by which I could allow a web-part to access/manipulate the underlying lists and libraries but restrict the user using the web-part from doing so as well as from accessing the Site Contents?

Thank you in advance.

Improve this question
1
  • 1
    You could set custom permissions on the lists/libraries themselves if you go to their settings.
    – spDevAdmin
    Jul 10, 2020 at 2:47

1 Answer 1

Reset to default
1

Per my test, users with View Pages permission automatically have access to the Site Contents page, which is the least permission users need to access SharePoint. So as long as the users have access to the SharePoint site, they can access Site Contents.

I suggest you create unique permissions for the underlying lists and libraries, and the web part page that you want the users to manage, and then give the link to the page directly to the users.

As the result, they will get Access Denied anywhere but the contents you give them access to in this site.

Improve this answer
2
  • Thank you very much for that. I indeed created unique permissions at the individual list and library level and that eliminated access to Site Contents. For the webpart page itself I set specific permissions as well. But the problem here is that the user still gets the "PAGE" tab available at the top and via that the ability to edit and delete the page. In the permissions, if I remove the "Edit Items" permission, the page access is denied. So is there any way to simply hide the "EDIT" tab because I don't think we can curtail the permissions and still allow access to use the page itself?
    – user6009780
    Jul 15, 2020 at 13:32
  • @user6009780 You can grant View Only/Read permission to the user on the page itself via Page Permissions, but keep the "Edit Items" permission just to the lists/libraries. In this way, the user will not be able to edit or delete the page, but still have the ability to manage the lists/libraries.
    – Chelsea_MSFT
    Jul 16, 2020 at 8:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.