Here is my requirement: I have a list of region/offices that is used to model the organization structure of a company. This list is used as a lookup in a list of manager users: so each manager is assigned to a region that he/she will manage. That means each of the node below will have manager assigned to them.

Europe Region
--East Europe
----Greece Office
----Turkey Office
--West Europe
----England Office
----Netherlands Office
--North Europe
America Region

Then I will have another list, that holds the staff(personnel) information for these regions/offices.

Region (Choice)
Office (Choice)

What I need is to implement some policy so that the managers of the regions/offices will only be able to enter/update the information of their staff.

That means, the manager of Turkey office will not be able to enter data for Greece office. Or the manager of Europe Region will not be able to see the data of America region. Which should need a hierarchial permission structure.

How can i provide this kind of permission structure in SharePoint. The only solution that comes to my mind is developing a custom NewForm and EditForm, then do the permission checks in code-behind.

What are your ideas? Any alternatives come to mind?

  • 2
    Sounds like a fantastic candidate for SharePoint Managed Metadata Claims Provider no ? mmcp.codeplex.com Dec 18, 2012 at 12:01
  • hi @FrancoisVerbeeck, this is the first time i've heard about MMCP. Do you think i can implement my requirement using this?
    – ozdogan
    Dec 18, 2012 at 12:57
  • It might be interesting to give a try. Otherwise, I would go with event receiver to have something up & running in a short amount of time. Finally, why not create folders (per office), relying on a library instead of list ? You could apply permissions on each folder to ensure only the manager of that office have the ability to edit and give a rollup read-only view without folder for everyone as the default view ? Dec 18, 2012 at 13:08

1 Answer 1


Quick idea: since it would seem that you have specific people/groups that should edit a specifi item of the list you should be able to assign a item level permission to an item so that only the espected user may edit it, right?

If that is the case - and if no other better solution is found - you can try to build an item event receiver that will update the item permission set based on the selected region. That way whenever an item is modified, the new permission would be applied.

Would a similar solution be acceptable?

Edit: about the cancel adding event - you could use the item adding event to check the user and redirect to an error page when appropiate. For example:

public override void ItemAdding(SPItemEventProperties properties)
    if (!UserCanAddThisItem(.....))
            properties.RedirectUrl = "/_Layouts/myCustomPage.aspx";           

This was based on this article: source. As you can see, you can define a custom page and then redirect the user as required. Remember to set the status to CancelWithRedirectUrl.

About the idea of developing a custom page and manage all the security inside that page, as said in the comments you could do it. It all comes down to a compromise: can you afford to constrain your user to use only the custom page? If the answer is yes, you could just remove all write permission from the target list and manage all edit/insert operation in a custom form. You will have to use RunWithElevatedPrivileges, but you would then be sure that no one will be able to add an item outside your managed page (or at last, no super-farm-admin-user will).

  • thanks for the enlightining idea. but your suggestion is valid for updating items. what about the first entry of the item. how can i deny, manager of another office to enter personnel info for other office
    – ozdogan
    Dec 17, 2012 at 12:51
  • 1
    Cannot you use an item adding event and cancel the add if the region doens't match the expected one for the current manager? You should also be able to send back an appropiate error message.
    – SPArcheon
    Dec 17, 2012 at 13:13
  • 1
    I am pretty sure that if you give custom permission to the list items the lookup is based to, you could obtain the result you describe. That said there should be a simplier way. Let me think about it.
    – SPArcheon
    Dec 17, 2012 at 15:37
  • 1
    Well, nothing out of the box comes to mind. Problem is: how would SharePoint associate the current user with an user in the maneger list (to use for the filter)? There is a custom field available on codeplex that may (never used it) provide some help: here. I am also wondering if claims could be used somehow.
    – SPArcheon
    Dec 18, 2012 at 9:25
  • 1
    @ozdogan, the page would have an evident advantage: it would easly support any new requirement you may add in the future, while a out of the box solution can reach its limits pretty fast. There ise one mayor problem that comes to mind though: you need to ensure that no user can bypass the page and add the items thru the list standard new item form.
    – SPArcheon
    Dec 18, 2012 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.