I want to have a workflow that only allows a certain change to be made by certain people: I only want people in the permissions group Library Authorisers to be able to save a document after changing the document's status to Live.

At the moment I have been experimenting with the If modified by... condition, setting the user to the name of the permissions group. Sadly this isn't working. I have a feeling this is looking at the group as an entity, rather than users within the group, but if I manually enter all the users then my successor will have to modify the workflow for any changes.

I had also considered something along the lines of If [workflow context: user] is in Library Authoriser, as I do something similar in an InfoPath form I have where I use User does not equal any instance of users in Group. It's a shame I can't use InfoPath for this task.

I have the rest of the workflow sorted out, and although it's a little complex this was the only way to achieve the requirements. Due to this can I ask that answers don't ask me to use OOB workflows instead. Also I can't use InfoPath and I don't have Viual Studio.

3 Answers 3


I'm still hoping there's a cleaner way to do this, but here's how I've solved this issue:

  • I created a list that contains the names of all authorisers stored in a Person Lookup column
  • I replaced my If modified by... condition with an If any value equals... condition
  • I set the first value as a lookup linking to the other list (image below)
  • I set the check to is not empty

This way the condition attempts to return the name from the Authorisers list that matches the name of the active user, and if it can't find them it returns nothing, resulting in a false for the condition.

Lookup settings for first value

  • I used your idea, but because I had some actions in an impersonation step, I had to do the people lookup outside the impersonation step and add the true or false into a variable. The variable was then read inside the impersonation step. Thanks for this! :) Jan 16, 2017 at 8:53

Can it be resolved with permissions? Give most users the ability to add and view items and give only your selected folks contribute rights. Then the on change workflow can only be triggered by the appropriate folks.

With this approach though, you might need to add some impersenation steps into the workflow depending on if the workflow is updating columns that the majority of users would no longer be able to do.

  • Sadly this won't work, no, as users need to be able to make other changes, they just can't make this one change. Bit annoyiong really but I didn't plan it. I've found a solution, shame it's such a hack though.
    – CLockeWork
    Aug 8, 2013 at 15:39

I am having trouble finding my example, which is why I did a search and found your solution, but... If you already have a user group they are all in, instead of having 2 places to update later as time goes on, I believe you could do a call http web service and use the "/_api/web/sitegroups/getbyid(" + GroupId + ")/users" api connection to fetch users and then loop through if user = modified by

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.