SharePoint Use Cases

  • Home
  • About
  • Our Tools
  • Contact me
SharePoint

Configure Item Level Permissions for Document Libraries – Part 2 – SharePoint 2010 edition

Toni Frankola - March 22, 2010

Every once in a while your customer might ask you to customize permissions for a document library in such a way that authors can only change their own documents. There was no such feature for document libraries in SharePoint 2007, and the “problem” is still present in v2010. (Both versions support automatic item-level permissions OOTB for other lists like Tasks).

In Part 1 of this article I tried to solve the problem for SharePoint 2007 with Workflows, but never found the time to complete it and create custom workflow activities for SharePoint Designer. In 2010, SharePoint Designer comes to the rescue, as it has similar workflow activities OOTB!

In this article we will examine how you can create a workflow that will customize item permissions for each document submitted to a document library (only Author will have contribute permissions). These SharePoint Designer 2010 workflow activities can also be used in various workflow scenarios where permissions need to be revoked after item is submitted (e.g. Annual Leave Requests, various approvals etc.).

Here is what you need to do:

  • Create a new Document Library (e.g. Top Secret Documents)
  • Go to Document Library Settings > Permissions for this document library
  • Click on Stop Inheriting Permissions command from the ribbon
  • Revoke permissions for all but few important groups (e.g. Portal Owners and Portal Members).
    Please note: Steps 2. – 4- are optional but workflow is going to be much simpler if there are fewer permissions to manage
  • Open your site in SharePoint Designer, and select Workflows option and your list from the ribbon
  • Type the name for the new workflow (e.g. Customize Permissions)
  • Insert a new Impersonation Step. This special step runs each activity as workflow author.
    Make sure workflow author (you) has proper privileges to manage permissions for this list.

  • From the list of workflow actions choose “Replace Item Permissions
  • Click Replace these permissions
  • In the dialog click Add
  • In the Choose permission to grant dialog click Contribute, and then click Choose… button
  • Add User who created current item to the Selected users list
  • Click the workflow name (e.g. “Customize Permissions”) to manage workflow settings

  • Make sure you have selected the correct Start options
  • Publish your workflow

Once a user adds a document to a document library this workflow will revoke permission from other users and grant contribute permissions to the document author.

You can also customize this workflow and add permissions for other users as well.

Tags | permissions, sharepoint 2010, sharepoint designer, workflows
 0
Share Now

Toni Frankola

Entrepreneur, IT consultant, speaker, blogger, and geek. Co-founder of syskit.com.

You Might Also Like

SharePoint

Let’s get started with SharePoint Designer!

April 3, 2009
SharePoint

My slides from SharePoint conference Peru

May 23, 2010
SharePoint, SharePoint 2010

Add a user to the SharePoint_Shell_Access role for all SharePoint 2010 content databases

January 27, 2012
SharePoint

Deploy Custom JQuery Scripts to the SharePoint Site Collection

March 27, 2009

7 Responses

  • SmartiePants April 11, 2013 at 5:55 pm

    I can’t thank you enough!!! This saved a TON of time for us here at the job.

  • jc May 28, 2013 at 10:09 pm

    I’m on o365/SPO 2013 using SPD 2013. I’m not seeing this impersonation step..Anybody know if this is possilbe up on the cloud? Please email me at jc (at) cyberpine (dot) com

  • danielkr July 5, 2013 at 9:25 pm

    Not wanting to go back in time, I am looking for a way to do the same thing in SharePoint 2013.

    Thanks,

    Daniel

  • Kirk August 13, 2013 at 7:44 pm

    Thanks for this guide!

    I’m using SP 2010. This method works, but only if the user in question has been explicitly granted permissions to the list ahead of time.

    For example, I’m using this on a task list to grant Contribute permission to the user in the ‘Assigned To’ field. First, I remove contribute permission to all users in the group, and then grant permission to the single user. In order for this to work, each user in the group needs to have permissions explicitly defined on the list, IN ADDITION TO the entire group. I suspect this is because the Action only ‘Replaces’ permissions, and can’t create them.

    Fortunately, I only have a few users. For large sites however, this would make for an administration nightmare.

    Does this mirror your experience, or is there away around this?

  • Mark March 3, 2015 at 6:24 pm

    This works great. Exactly what I needed to do. Thanks!

  • Michael October 21, 2015 at 11:23 pm

    If you are trying to restrict read access for sensitive information then you will not want to use this for item level security. While the workflow is running, the document will be exposed to all who can view items until the workflow completes. While the doc is only exposed briefly, it is still a risk for sensitive info.

  • Vijay October 3, 2017 at 3:43 pm

    impersonation will be enabled when you click out of the step area. Lots of people are getting confuse.

  • Comments are closed.

    Previous Post FREE SharePoint 2010 eMagazine has been published
    Next Post I’ll be speaking about SharePoint at Microsoft Windays 2010

    Archives

    • December 2021 (1)
    • June 2021 (1)
    • January 2021 (1)
    • July 2019 (1)
    • June 2019 (2)
    • March 2019 (1)
    • February 2019 (3)
    • October 2018 (2)
    • August 2018 (2)
    • June 2018 (1)
    • April 2018 (1)
    • February 2018 (1)
    • January 2018 (1)
    • June 2017 (1)
    • April 2017 (1)
    • February 2017 (1)
    • November 2016 (2)
    • August 2016 (1)
    • July 2016 (2)
    • March 2016 (1)
    • February 2016 (2)
    • January 2016 (1)
    • November 2015 (2)
    • December 2014 (1)
    • November 2014 (2)
    • July 2014 (2)
    • June 2014 (2)
    • May 2014 (1)
    • April 2014 (2)
    • March 2014 (1)
    • February 2014 (4)
    • January 2014 (2)
    • December 2013 (1)
    • September 2013 (1)
    • July 2013 (1)
    • June 2013 (1)
    • May 2013 (1)
    • April 2013 (3)
    • February 2013 (1)
    • December 2012 (1)
    • November 2012 (1)
    • September 2012 (1)
    • August 2012 (1)
    • July 2012 (2)
    • June 2012 (4)
    • April 2012 (1)
    • February 2012 (1)
    • January 2012 (1)
    • November 2011 (2)
    • October 2011 (2)
    • September 2011 (2)
    • July 2011 (3)
    • May 2011 (2)
    • April 2011 (1)
    • March 2011 (4)
    • February 2011 (3)
    • January 2011 (4)
    • December 2010 (4)
    • November 2010 (3)
    • October 2010 (3)
    • September 2010 (4)
    • August 2010 (1)
    • July 2010 (4)
    • May 2010 (2)
    • April 2010 (2)
    • March 2010 (3)
    • January 2010 (2)
    • December 2009 (3)
    • November 2009 (5)
    • October 2009 (2)
    • August 2009 (7)
    • July 2009 (3)
    • June 2009 (4)
    • May 2009 (3)
    • April 2009 (5)
    • March 2009 (8)
    • February 2009 (5)
    • January 2009 (8)
    • December 2008 (9)
    • November 2008 (8)
    • October 2008 (7)
    • September 2008 (4)
    • August 2008 (6)
    • July 2008 (5)
    • June 2008 (3)
    • May 2008 (4)
    • April 2008 (6)
    • March 2008 (4)
    • February 2008 (3)
    • January 2008 (6)
    • December 2007 (1)
    • November 2007 (3)
    • October 2007 (3)
    • September 2007 (2)
    • August 2007 (1)
    • July 2007 (12)
    • June 2007 (2)
    • May 2007 (3)

    Connect Us

    All postings on this blog are provided “AS IS” with no warranties, and confer no rights. All entries in this blog are my opinion and don’t necessarily reflect the opinion of my employer.

    • Home
    • About
    • Our Tools
    • Contact me

    Copyright (c) Toni Frankola 2008. - 2019.