0

We have a SP Online list that users save info to via Nintex forms. The requirements are:

  1. the user can only view/edit items they've submitted
  2. the user's designated manager should be able to view, but not edit, that item (or any other item they are designated as a user's manager). The manager should not be able to view anyone's item they are not designated the manager of.
  3. the Site's owners should be able to view/edit any item in the list

Any number of different users throughout the organization could complete the Nintex forms and thus add entries into the list. Some users will have the same manager, some will have different managers.

Requirement 1 is easy through setting the "Create items and edit items that were created by the user" and "Read items that were created by the user" under the list's advanced settings; Requirement 3 is easy to set.

We're having issues trying to figure out how to implement requirement #2. Is this even possible? We've tried setting the user's manager permission at the item level to "read" but that still doesn't give the manager access.

Seems like the user's manager can only view the user's item if we give the manager "design" access. however, that defeats the purpose as the manager can then view/edit any other item in the list.

How can we accomplish this? Do we have to do something fancy like break inheritance with permissions and/or create a secondary list to manage permissions?

Thank you.

Improve this question

1 Answer 1

Reset to default
0

I wouldn't recommend item level permissions, since this becomes very difficult to manage if you need to make changes in the future (you would need to change the permissions of each item individually). It's also bad for performance.

It sounds like you need to create a bespoke user interface that interacts with the SharePoint list on behalf of the user. The system would determine what they should be able to see based on their role/metadata. The user interface could be a .NET web application or alternatively a Power App (assuming you create your own API to interact with the SharePoint list).

Improve this answer
2
  • Currently using Nintex forms and Nintex Workflow Cloud; currently the NWC is setting the item level permissions in the workflow based on who's entered as the employee's manager. When the submission is complete, the manager is removed from the item level permissions via the NWC workflow as well. So most of it is automated. We can see when viewing the item permissions that the manager is given 'read' access, but they're not able to view the item. Rewriting to use .Net or PowerApps isn't an option.
    – Do What You Love
    Jan 18 at 1:15
  • I can't recommend having a lot of item level unique permissions because of the points in my answer, as well as Microsoft's own guidance: learn.microsoft.com/en-us/office365/servicedescriptions/… The manager can't view the item because you are using the "Create items and edit items that were created by the user" which overrides that read access to the item. They'll need a higher permission level to view other user's created items with this enabled.
    – Callum Crowley
    Jan 18 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.