Is there a way to stop editing an item when the approval status is in the pending mode in SharePoint Online list? i.e. restrict users to change an item when it is waiting for the approval process. I have also access to Power Automate if I need to do anything specific there.

3 Answers 3


Why dont you set item level permissions in your workflow.

In your workflow once you start the approval process set the item level permissions as per your need (read access in your case).

Next check the outcome (i.e. if it is approved or rejected as per your condition) reset the item level permissions.

This way user will have only read only access to your item once the approval process starts. And once the item is approved/rejected (i.e. as per your requirement) you can again reset inheritance so that it will inherit permissions from the parent list. So the user will get accesses as it was before.

  • Thanks @Rohit, can I accomplish this in MS flow? It seems not possible," Item level permission could be managed within SharePoint itself and cannot be modified in flow. " I have done all of my works in the MS flow, and I do not want to create a workflow which may create a conflict with MS flow? Does it? Any solution regarding the version control? Nov 17, 2020 at 6:51
  • 2
    I think you need to use REST API (Send an HTTP request to SP) for changing permissions in flow. Nov 17, 2020 at 6:53
  • @GaneshSanap I think so, I am googling that, do you have a guide for it? Nov 17, 2020 at 6:54
  • Found this but not sure if works netwoven.com/2020/11/03/… Nov 17, 2020 at 6:55
  • 1
    As @GaneshSanap suggested, you can make REST call in MS fLow. I have managed item level permissions many times using REST + Workflow. It works perfectly. It should also work with Ms flow.. Nov 17, 2020 at 8:11

For locking purpose, you can check out this post: Locking a file for approval.

It uses custom flow process with Content Approval off and check out the document using flow.

In addition to the other Answer: if you want to change user permission using Flow, here is a blog that might do some help: Power Automate and SharePoint Permissions.

  • these are great to know, thx for sharing, Grant access to an item or a folder needs recipients to assign the role to. Can I use a group name instead of individual emails, it seems I cannot do it. If I use API I need to know the group name, Since different groups and users are working on the same list it is not very easy to keep track of all the users, Maybe Excel, as a user repos.I leave this as the last solutn, is there an easier way to just change it to view mocd for everyone except admin? maybe disable the save button when in the pending mode?sth like this but for MS flow, NOTin SP desinger Nov 18, 2020 at 2:58
  • @MohsenSichani The Grant access to an item or a folder action accepts Microsoft 365 group with email in the Recipients field, so you can use a group name instead. You can run a simple test using the mentioned actions, I have tested and it does remove all permissions on the item except for admins. Nov 19, 2020 at 5:28
  • I have created those groups in SP and when I enter the name of this grp (not from office 365) it does not accept it (Error: recipients are required), As you said, this action only works if such groups exist in office not in SP Nov 19, 2020 at 19:59

Thanks to both @Chelsea and @Rohit, the credit should go tho them, their answers were very helpful (as one upvoted and I accepted the other as the answer). However, for the sake of completeness I am posting the steps below:

Each list inherits its permission from the site and this must be broken if we need unique permission for each list, however, even if we do this and assign unique permission to each list, then each item of the list inherits the list permission. So, we need to break this inheritance, do the changes in item permission (as demonstrated in the link provided by Chelsea), and then restore it (as Rohit has mentioned).

To assign new permission to an item of a list, we need to have the PID of the group that we want to assign new permission. PID stands for Principal ID and is different for each user group. In here the author suggested sending a REST API and get this dynamically. This is helpful but I think there is a limit of 2k SP API calls per developer, so if we have lots of changes or lots of lists, we ran out of this. So, I created an Excel file and stored the list name, group name, and PID. To get the PIDs for the group list, I ran the below call:


I saved it in a notepad, rename the extension to XML and opened it with EXCEL, then removed the duplicates and came up with unique PIDs and group names. Then I added the list name (ListName) to this date and saved it in an Excel in SP like below (I have also added a column called "Site" for different use):

enter image description here

Note: all the members should be part of a group otherwise, you need to call the API for each individual user rather than once for the group.

An item in my list before editing looks like this (also attention to the edit icon on the top left): enter image description here

Now, my flow looks like this: Ignore the condition, it is for my personal use

enter image description here

The details of breakinhertance and read excel are as follow: (you can use ONE filter expression in Excel too)

enter image description here

and the "Apply to each" loop enter image description here

and finally, remove the permission for all the groups of this item of this sp list: enter image description here

Now let's have a look at the permission level of an edited item is SP (with remvoing permissions) enter image description here

so we have removed the editing permission as there is no edit on top left and the number of groups have been reduced.

Now, the admin sees the request and approve it, the rest is easy, just we need to restore inheritance action after changing the approval status.

enter image description here

and finally, the permission level of the item looks like: enter image description here

Everything is normal as it is supposed to be!:)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.