Best Practice: Dynamically changing Item-Level permissions?

Hi all,
Can you share your opinion on the best practice for Dynamically changing item permissions?
For example, given this scenario:
Item Creator can create an initial item.
After item creator creates, the item becomes read-only for him. Other users can create, but they can only see their own entries (Created by).
At any point in time, other users can be given Read access (or any other access) by an Administrator to a specific item.
The item is then given edit permission to a Reviewer and Approver. Reviewers can only edit, and Approvers can only approve.
After the item has been reviewed, the item becomes read-only to everyone.
I read that there is only a specific number of unique permissions for a List / Library before performance issues start to set in. Given the requirements above, it looks like item-level permission is unavoidable.
Do you have certain ideas how best to go with this?
Thank you!

Hi,
According to your post, my understanding is that you wanted to change item level permission.
There is no out of the box way to accomplish this with SharePoint.
You can create a custom permission level using Visual Studio to allow users to add & view items, but not edit permission.
Then create a group with the custom permission level. The users in this group would have the permission of create & add permission, but they could no edit the item.
In the CodePlex, there is a custom workflow activities, but by default it only have four permission level:
Full Control , Design ,Contribute and Read.
You should also customize some permission levels for your scenario.
What’s more, when use the SharePoint 2013 designer, you should only use the 2010 platform to create the workflow using this activities,
https://spdactivities.codeplex.com/wikipage?title=Grant%20Permission%20on%20Item
Thanks & Regards,
Jason
Jason Guo
TechNet Community Support

Similar Messages

Workflow not triggering when changing Item-level Permissions in Sharepoint 2013 list

Scenario:
We have a custom list in Sharepoint 2013 that we use for Case Management. We have a workflow that triggers on a created item generated from an email. The user then gets a reply with a link to his own case.
I want the users only to be able to see their own cases and no one elses. When I change this under
Advanced Settings under List Settings and
Item-level Permissions and set them to Read items that were created by the user
and Create items and edit items that were created by the user
the workflow doesn´t trigger.
How can I resolve this? I've tried every possible out-of-the-box permissions but with no result. Help!
Thanks in advance!
// Browncreek

When you're testing , remember you cant trigger declarative workflow from the System Account - you need a general user account for auto-trigger workflows. Good luck!
Chris McNulty MCSE/MCTS/MSA/MVTSP | blog http://www.chrismcnulty.net/blog | twitter @cmcnulty2000 Microsoft Community Contributor Award 2011
Hi, I have the same problem. Except that I am not using an email to create a new item. The item is created by members of a SharePoint group that have Contribute access to the list. When use the same settings i.e.
Read items that were created by the user and Create items and edit items that were created by the user,
the workflow does not trigger. If I set it back to Real all items and Create
and Edit all items, it triggers the workflow.
Please help me resolve as I have rolled this out to pilot users and am having this trouble.
Thanks,
Vishal

Item Level permissions document library

In SharePoint 2010 you could apply item level permissions to document libraries via PowerShell with
$web= Get-SPOSite "sitename"
$list = $web.Lists[“Listname”]
$list.ReadSecurity = 2
$list.Update()
$web.Dispose()
Is there a way to apply this to SharePoint online 2013? it doesn't seem to work.

Hi SpNerd,
For SharePoint 2013 Online, there is not a comdlet that is used to get a site. So, it seems that there is not a way to change Item-level permissions via PowerShell for SharePoint Online.
Windows PowerShell for SharePoint Online cmdlets
http://technet.microsoft.com/en-us/library/fp161364(v=office.15).aspx
As a workaround, you can change Item-level permissions via SharePoint Online UI as List Settings->Advanced Settings->Item-level Permissions.
I hope this helps.
Thanks,
Wendy
Wendy Li
TechNet Community Support

What is the best practice for changing view states?

I have a component with two Pie Charts that display
percentages at two specific dates (think start and end values).
But, I have three views: Start Value only, End Value only, or show
Both. I am using a ToggleButtonBar to control the display. What is
the best practice for changing this kind of view state? Right now
(since this code was inherited), the view states are changed in an
ActionScript function which sets the visible and includeInLayout
properties on each Pie Chart based on the selectedIndex of the
ToggleButtonBar, but, this just doesn't seem like the best way to
do this - not very dynamic. I'd like to be able to change the state
based on the name of the selectedItem, in case the order of the
ToggleButtons changes, and since I am storing the name of the
selectedItem for future reference.
Would using States be better? If so, what would be the best
way to implement this?
Thanks.

I would stick with non-states, as I have always heard that
states are more for smaller components that need to change under
certain conditions, like a login screen that changes if the user
needs to register.
That said, if the UI of what you are dealing with is not
overly complex, and if it will not become overly complex, maybe
states is the way to go.
Looking at your code, I don't think you'll save much in terms
of lines of code.

Sharepoint 2013 / Office 365 Document library item level permissions problem

Hello,
I'm looking for a solution to enable users to upload documents to a document library, the ability to view other documents uploaded to the same document library, but able to edit or delete those other documents.
With a list you can use Item-Level security in Advanced Settings but this is not available for Document libraries. I could use workflows to assign individual permissions to document, but the the library already contains over 2,000 documents and will continue
to expand so I don't like the idea of having that many individual permissions set.
Are there any 3rd party plug-ins or solutions to this issue?
Thanks,

Try below:
http://www.hersheytech.com/Blog/SharePoint/tabid/197/entryid/28/Default.aspx
As it turns out the, setting Item-Level Permissions in a library is fully supported with PowerShell!
The PowerShell commands for changing this are very simple:
$web = Get-SPWeb http://YourSite/
$list = $web.Lists[“Your Document Library Name”]
$list.ReadSecurity = 2
$list.Update()
$web.Dispose()
Note the 3rd line which is where you determine the value for this setting using the following values:
1 = “Read all items”
2 = “Read items that were created by the user”
If you wish to modify the values for Create and Edit access instead, replace .ReadSecurity with .WriteSecurity with
the following values:
1 = “Create and edit All items”
2 = “Create items and edit items that were created by the user”
4 = “None”
For example:
$web = Get-SPWeb http://YourSite/
$list = $web.Lists[“Your Document Library Name”]
$list.WriteSecurity = 2
$list.Update()
$web.Dispose()
Also check
http://sppermissions.codeplex.com/
If this helped you resolve your issue, please mark it Answered. You can reach me through http://freeit-support.com/

Item-level Permissions availabe in list advance setting not working.

Hi,
Recently i had an requirement of maintaining item level permission. My requirement was that whenever an item is created in list, it should be created with uniqure permission. I know how to do it by writing
custom code, but i don't want to do it with any code as client doesn't need any dll etc. After explroring i found that there is an option available in List's advance setting. Following are the steps i followed:-
Go to List settting.
Go to Advance setting.
In advance setting we have "Item-level Permissions" as one of option. This option have two
sub options.
For Read Accesss
select "Read items that were created by the user"
For Create and Edit access select "Create items and edit items that were created by the user"
Save the above settings.
Below is the screen shot for above mentioned setting:
Expected behaviour from above setting are:
Users can create new items
User can view and edit items only those item that are created by them.
But i found there is not change in item level permission. All users can View and
Edit items created by other users. May i am
misunderstanding above setting or there is Bug in sharepoint. Please help me if any body have any idea about it.
Regards,
Deepak
Deepak Kejriwal

Make sure that users have "Contribute" permission to the list, if the users have more permission at site level, then the list permission will be overridden by site permission.
Refer the following article for more info.
http://office.microsoft.com/en-us/windows-sharepoint-services-help/permission-levels-and-permissions-HA010100149.aspx
--Cheers

Dont allow to change item level data in sales order.

Hi all,
I have a requirement in which, users should not be allowed to change item level data or not allowed to add any new items in sales order on a certain condition. But they should be allowed to change the header level data.
How can i achieve this.
Can anyone help me?

Hi,
Check below exit.
MV45AFZZ and in form USEREXIT_MOVE_FIELD_TO_VBAP.
Here check for ur validation, If passes then CHECK variable SVBAP-TABIX. If it is 0 then item is created. If it is GT 0 then item is changed. Other way could be...
select data from VBAP for each sales document and item in xvbpa internal table.
If for any item u don't have data in VBAP table that means u r adding that item. So issue error message.
*       FORM USEREXIT_MOVE_FIELD_TO_VBAP                              *
*       This userexit can be used to move some fields into the sales *
*       dokument item workaerea VBAP                                  *
*       SVBAP-TABIX = 0: Create item                                 *
*       SVBAP-TABIX > 0: Change item                                 *
*       This form is called at the end of form VBAP_FUELLEN.          *
Thanks,
Vinod.

Alerts on a list with Item Level Permissions.

We have an IS Request list that people can email with their problems. We recently switched to Item Level Permissions where users can only see the requests that they created. IS has full control rights over the list and can see all the
items.
Our issue is that the alerts dont work in this type of list and SharePoint Designer alerts are hokey and less dependable.
Thoughts?
Devster

You can use the IAlertNotificationHandler interface to intercept the e-mail alert and to modify it.
Please check this thread below.
http://social.msdn.microsoft.com/Forums/sharepoint/en-US/29efe27c-26c2-407e-b771-4f77971238ef/alert-problem-permissions?forum=sharepointgeneralprevious
My Blog- http://www.sharepoint-journey.com|
If a post answers your question, please click Mark As Answer on that post and Vote as Helpful

Always Get Edit Link When Item Level Permissions Set

We've enabled item-level permissions in a folder, and all users receive the "edit folder" button, regardless of whether we've given them "manage" access. Turning off item-level permissions removes the edit link.
Is this a known issue? Any workaround/solution?

That's just a "feature" of item level security, I don't think Oracle has any plans to fix it in 3.0.9X they probably have resolved the issuse in 9.0.2 ..... If you really need it gone you can click "Edit Defaults" when editing the page, right next to the portlet and uncheck the box that says show "Show Edit Link".. But then you just taken away the easy ability of editing the items through the portlet and you have to go back to the Content Area to update anything.
brad

SharePoint 2010 Item level permissions nightmare...how do I escape this madness?

We have a custom SharePoint 2010 application that helps process job req. documents from 200+ partner companies. Each company can only see its own job req. documents (done using item level permissions in one document library).
The number of documents is getting close to 3k. I've read that once you get over 5k, you'll see a huge performance hit because of the number of unique security scopes.
Creating 200+ libraries is out of the question. That just seems like an even bigger logistical nightmare...especially since we add partners every month almost. We have reports that run off of this data and querying that many libraries would be nuts.
Next would be making folders for each company. A lot of recoding would need to be done, but my biggest concern will be not being able to sort and filter properly.
I've tried writing a PowerShell script to copy everything into folders in a new library and the filtering doesn't work even after messing around with the view to not show the folders at all.
The last thing I'm considering is just archiving older data that may no longer be relevant by year or something.
Has anyone else run into a similar issue?
Any suggestions?

Hi,
Once you have exceeded the threshold limit, certainly there will be performance issues. However, you can still iterate though lists/libraries that exceed threshold limit by workaround here:
List Threshold
Additionally, please refer following link which demonstrates how you can implement sorting/paging for lists exceeding threshold limit:
https://social.msdn.microsoft.com/Forums/en-US/4f788144-773c-4e63-8c1f-1e51f1c0a82f/client-object-model-fsobjtype-and-list-view-threshold?forum=sharepointdevelopmentprevious
Hope it helps!
Thanks,
Avni Bhatt
If this helped you resolve your issue, please mark it Answered

User exit to change item level data in purchase order

Hi,
Can anyone let me know the user exit to change item level data in purchase order . there is a badi ME_PROCESS_PO_CUST for this but the issue is its method process_item gets triggered only when the item is changed. My requirment is
For purchase order document types u201CZSOu201D and u201CZCOu201D, where the purchase order is a u201CLimits Orderu201D only i.e. no materials or services on the purchase order, the print price indicator field should be set to u201Cblanku201D (unchecked). now i cant use ME_PROCESS_PO_CUST because process_item wont get triggered if there is no change in itemlevel data.
Regards,
Rahul

Hi Rahul,
Probably EXIT_SAPLMEKO_002.
hope it helps,
Edgar

Problem with setting Item level permissions lists

Hello!
I have SPS 2013 on-premised environment with AD authentication.
At some moment I've noticed that we have a problem with setting the item level permissions on any lists except the document libraries.
When I click the "shared with" button I see a popup form with a list of users who have an access to that list but there is no "invite people" link or "Advanced" link. Moreover, the "loading" ring rotates
instanly like some operation was'nt ended.
The same operation with documents in libraries works well.
I am be grateful for any help!

Hi Mischael,
From your description, my understanding is that there were no "invite people" or "Advanced" link when some users clicked "shared with" button in some lists.
This issue seems like about permissions. Please log on your site with site collection administrator or a user who has full control for the site, then go to a problematic list->List settings->Permissions for this list, check whether the list
has unique permissions. Then click "Check Permissions", check the permission level for the problematic users and then go to Site Settings->Site permissions->Permission levels, check whether the permission level contains "Manage permissions".
If not, add the permission into the permission level.
Thanks,
Wendy
TechNet Community Support
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
[email protected]

Best Practice for Change Maintenance Order Number Range

Hello
We have decided that our Maintenance Orders will always start with the year of the open date. Example 201112345155
Every year we will need to change the number ranges
What is the best practice to change the order number range? What is the best approach here?
I have also another question. Why the "Current Number" is not incremental?
Thanks for the help

Hi,
The current number can be explained by use of buffering of the numbers. Buffering is defined via transaction SNRO, the AUFTRAG object is relevant for orders. When buffering is active, a set of unused numbers are assigned to each application server.
In your example - The fiirst 20 numbers were taken from the available number range and assigned to the buffer (possible 10 numbers to each of two servers). As orders are created a number is assigned from the buffer. Once the buffer values are used a further set of numbers are taken from the number range and the current number is increased (by buffer value).
-Paul

Workflow for Changing Item Level Permission in SharePoint 2013 (Office365)

I am using OOTB Tasks List in SharePoint 2013 (O365). Now my scenario is like this:
I have two user groups: 1.Sales Managers 2. Sales Executives
Sales Managers can create & assign task to Executive. I want something like Sales Managers Can view all tasks (Which is by default view of tasks list i.e. perfact) but Executives can see only their tasks assigned to them. How can I achive this?
Can I use WorkFlow for this to Change item level permission or to assign permission to assigned to user? or JS
Can anyone have proper solution? thanks

1. make 2 SharePoint group 1>Sales Managers 2>Sales Executives
2. Show 2 WP of same task list in same page.
3. Use Audience Target for Sales Managers Sharepoint group in first Webpart property. (All
Iten view)
4. Show "My Task" view (assign to =[Me]) Bottom WP for same task list and use Audience Target for Sales Executives. Or if you want it to see
Sales Managers as well, the dont use any Audience Target.
Bottom line - SharePoint group use in Audience Target will do the trick. OOTB
Regards Sudip Misra [email protected] +1-412-237-5435 Pittsburgh, PA

Change item level security using wwsbr_api.modify_item

Hi.
Im using wwsbr_api.modify_item for change item level security.
Its code for change type access for item of my procedure
l_masterid := portal30.wwsbr_api.modify_item(
p_master_item_id => 7061,
p_item_id => 7062,
p_caid => 136,
p_folder_id => 1,
p_display_name => 'test',
p_region_id => 5,
p_access_level => portal30.wwsbr_api.item_access,
p_text => 'test change item security',
p_addnewversion => true, -- My content area have item versioning
level is audit
After execute my procedure access type = folder.
I see in wwv_things table new record
masterthingid = 7061,
id = 7064,
security = 'folder'
How to change item level security programmatically?
Thanks

Jerry,
Please forgive me for persisting with this, and thankyou for your continued patience, but let me try to explain the issue I'm having in another way...
I have a function that calls wwsbr_api.modify_item to change, say, the description. In this case "description" is the one and only thing I want to change about the item. As you've described above, I am able to query most things associated with the item (via wwsbr_all_items, wwsec_api.grantee_list, etc) so that I can pass current values to the wwsbr_api.modify parameters. However, I haven't found a way to query the current level of access control for a given item (i.e. wether it is currently set to ITEM_ACCESS, FOLDER_ACCESS, or null). As documented, I can force the item to be ITEM_ACCESS or FOLDER_ACCESS. However, I don't want to force a value and as we have concluded, passing null will nullify the current state.
So, in summary, an answer to this question will solve my problem:
Is it possible to query the current access control level of an item (either directly via one of the published views or indirectly via one of the views)?
If the answer is yes - great that solves my problem. How please?!?!?
If the answer is no - this must be a bug is it would mean that it isn't possible to use wwsbr_api.modify_item without inadvertently altering the current access control level of the item.
Again thanks for your patience...
Mark

Best Practice: Dynamically changing Item-Level permissions?

Similar Messages

Maybe you are looking for