2

We have a travel request application. where a user submit a request where it should go into 2 stages of approval process before it gets Final Approval.

Now we did the following:-

  1. Create a SharePoint list which contain those fields; Title, Description, StareDate, EndDate, FirstApproval (the requestor direct manager), SecondApproval (the requester regional approval), Statues (system-generated with those options; open, first-approved, second-approved, Final-Approved).

  2. Power Apps, which send emails to the first-approval and the second-approval users , and show-hide the Approved & Reject buttons based on the item status.

  3. Power Automate,to set item-level permissions, so for example when the item needs first-approval only the approval's direct manager can edit the item, while all stakeholders can read-only.

now the process is not 100% secure, as a requestor using API call or using SharePoint built-in forms, can easily create a new request and define its status as Final-Approved. so in other words the requestor can bypass the Power Apps business logic. so how we can secure our process? so if an item has a status = "Final-Approved", then we can 100% sure that it actually went through the 2 approvals users? Thanks

One Approach i am thinking of, is as follow:-

  1. To create additional SharePoint list >> which stores the ItemID + ItemStatus.

  2. Grant all users Read-Only on this new list while grant the service account Contribute.

  3. Update this new list from Power automate Only. so for example only if the submitter's direct manager did the approval, to change the status inside the new list to First-Approved, and so on.. Also only if the submitter's regional manager approve the request + there is already an approval from the direct manager to change the status from First-Approved to Second-Approval.. so what ever the status is inside the new lit i can be sure that it has not been hacked, as end-user will have read-only on this new list.. can anyone advice please?

Thanks

Improve this question
10
  • 1
    Approach which you have suggested will work according your requirement and can handle security scenario which you have mentioned
    – Kalpesh Vaghela
    Aug 2 at 5:49
  • 1
    And even you handle it using Power Apps -> from backend / API, use will able to update column value if they have at least Create/Edit rights (Only if use is technical)
    – Kalpesh Vaghela
    Aug 2 at 9:15
  • 1
    I meant it for your main list not for list where you are storing Item ID and Item Status. So in summary the approach which you have described will fit according to your requirement.
    – Kalpesh Vaghela
    Aug 2 at 12:18
  • 1
    As per your approach, you are managing status in different list and you make that separate list read-only for those use via SharePoint permission, then Submitter can't do that even using API
    – Kalpesh Vaghela
    Aug 4 at 6:55
  • 1
    Yes. that's what I am trying to explain from start :)
    – Kalpesh Vaghela
    Aug 4 at 8:56

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.