I have a Leave Request App that I have built, I want for all employees to use the Leave Request App, so I built a Power Apps Security Group in the portal and added every employee, easy.

My issue is a Leave Request List app and new users .

I wish for only people who created the Leave Requests, their managers, the supervisor whom approved to be able view each others leave.

I was able to achieve this by removing inherit permissions of the site (the Teams site the leave request is on is a public site), and then i created a flow to break all permissions for all old rows in the list and then restore the permissions to the creator of the leave, their manager and the approver for all the old rows in the list.

I then created a flow that triggers from when a new item is created, stop sharing and then give access to relevant parties.

However I then got errors in the power app from people whom where not already in this list, i.e. new users trying to put in leave requests. I discovered it is because they do not have the permission to add (Edit) permission so I then had to add the Power apps Security group to that lists permission and give it Edit access, now however now I have broken it and others can see each others new entries.

What is the correct way to set this up?

1 Answer 1


One way to achieve this without breaking the permission inheritance and causing issues with new users is to use SharePoint item-level permissions.

You can create a SharePoint group for each manager and supervisor and assign the appropriate users to each group. Then, create a SharePoint workflow or Power Automate flow that runs on item creation and assigns permissions to the item based on the creator, manager, and supervisor fields.

For example, the workflow can check the creator field and assign read access to the creator, edit access to the creator's manager group, and edit access to the supervisor who approved the leave request. This way, only the creator, their manager, and the supervisor who approved the request can view and edit the item.

You can also create a SharePoint group for all employees and give them read access to the list, so they can view all the leave requests but can't edit them unless they're the creator, manager, or supervisor.

This approach allows you to control the access to the list without breaking the permission inheritance and causing issues with new users.

  • Sorry im not understanding fully. If i have a public sharepoint site and i want new users to add/edit rows, i would still need to add them in the permissions section. Can i not just add a security group and then give limited accesss? May 5, 2023 at 2:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.