Sharepoint 2007 Setting Item level permission

How do i set item level permission using SharePoint 2007 workflow. As I've been working on employee leave management, time sheet entry and attendance, quite similar to Orange HRM features...And also being a beginner who never had any hands on SharePoint.
It would be really grateful if anybody comes up with all the help for me.
Employees should not be able to see each other's personal information like contact details, email addresses, etc other than the Admin. How do i do that step by step automatically using a workflow using SharePoint 2007....?
Thank You.

you can use the http://spdactivities.codeplex.com/ Grant Permission on Item workflow activity from codeplex and build the workflow.
Below are the few examples
http://sharepointgeorge.com/2010/item-level-permissions-infopath-forms-sharepoint-designer-workflows/
http://www.codeproject.com/Articles/18415/Custom-Activity-Workflow-for-implementing-Item-Lev
hope this helps.
My Blog- http://www.sharepoint-journey.com|
If a post answers your question, please click Mark As Answer on that post and Vote as Helpful

Similar Messages

How to set item level permission for list item in SharePoint 2013

Hi we had a custom List "ABC".
List had 2 columns:
Project Name: (P1, P2, P3, P4, P5, P6)
Project Leads: (PL1, PL2, PL3, PL4, PL5, PL6).
All project Leads can have permission to edit only their Project (P1, P2, P3) like
PL1 can edit P1
PL2 Can edit P2.....
But my Question is how to restrict PL2 cannot have permission to edit P1
is it possible to set permission for this through OOTB in SharePoint 2013.
Any help will be appreciated......

Hi
check this similar post
http://social.technet.microsoft.com/Forums/ro-RO/e1ea3655-0c6f-4b3d-a336-c42e8eb54c09/rights-to-edit-own-items-for-list-residing-on-publishing-site?forum=sharepointdevelopmentprevious
Romeo Donca, Orange Romania (MCSE, MCITP, CCNA) Please Mark As Answer if my post solves your problem or Vote As Helpful if the post has been helpful for you.

SharePoint OOB Item level Permission under List Settings

Users & Roles:
Authors: User with author role can create a new item but can only edit/delete their own items and not other user items. They should not modify or view the list settings(Permission level - Contribute)
Editor: User with Editor role can create a new item and can Edit/Delete their own items and also other user items. They should not modify or view the list settings(Permission level - Contribute)
1. Created a new list.
2. In advance setting enabled "Item-level
Permissions" as follows,
For Read
Accesss selected "Read all items"
For Create
and Edit access selected "Create items and edit items that were created by the user"
Now, User with Editor access can't able to Edit/delete other user items but can able to Edit/Delete their own items(same as user with Author role).
Then i have changed the Editor access Permission level to
Edit. In Edit Permission level i have enabled Override Check-Out
and disabled Manage Lists. But still user with Editor access doesn't satisfy the condition.
kindly help me on this to resolve the above issue.
For Read
Accesss select "Read items that were created by the user"
For Create
and Edit access select "Create items and edit items that were created by the user"
For Read
Accesss select "Read items that were created by the user"
For Create
and Edit access select "Create items and edit items that were created by the user"
For Read
Accesss select "Read items that were created by the user"
For Create
and Edit access select "Create items and edit items that were created by the user"

Hi Nishok,
Agree with Paul's opinion, you can create an event receiver to set Item Level Permission. Here is the snippet:
using System;
using System.Diagnostics;
using System.Threading;
using System.Windows.Forms;
using System.Security.Permissions;
using Microsoft.SharePoint;
using Microsoft.SharePoint.Utilities;
using Microsoft.SharePoint.Workflow;
namespace ItemLevelSecurity.ItemSecurity
/// <summary>
/// List Item Events
/// </summary>
public class ItemSecurity : SPItemEventReceiver
/// <summary>
/// An item was added.
/// </summary>
public override void ItemAdded(SPItemEventProperties properties)
SPSecurity.RunWithElevatedPrivileges(delegate()
try
using (SPSite oSPSite = new SPSite(properties.SiteId))
using (SPWeb oSPWeb = oSPSite.OpenWeb(properties.RelativeWebUrl))
//get the list item that was created
SPListItem item = properties.ListItem;
//get the author user who created the item
SPFieldUserValue valAuthor = new SPFieldUserValue(properties.Web, item["Created By"].ToString());
SPUser oAuthor = valAuthor.User;
//assign permissions to task author
AssignPermissionsToItem(item,oAuthor,SPRoleType.Reader);
//update the item
item.Update();
base.ItemAdded(properties);
catch (Exception ex)
properties.Status = SPEventReceiverStatus.CancelWithError;
properties.ErrorMessage = ex.Message;
properties.Cancel = true;
public static void AssignPermissionsToItem(SPListItem item, SPPrincipal obj, SPRoleType roleType)
if (!item.HasUniqueRoleAssignments)
item.BreakRoleInheritance(false, true);
SPRoleAssignment roleAssignment = new SPRoleAssignment(obj);
SPRoleDefinition roleDefinition = item.Web.RoleDefinitions.GetByType(roleType);
roleAssignment.RoleDefinitionBindings.Add(roleDefinition);
item.RoleAssignments.Add(roleAssignment);
Best Regards,
Eric
Eric Tao
TechNet Community Support

Setting Item level access rights on sharepoint list item in ItemAdding event handler

Hi ,
I am using sharepoint 2013. I am trying to set item level access rights when a list item is added using the following code snippet,
public override void ItemAdding(SPItemEventProperties properties)
base.ItemAdding(properties);
ConfigureItemSecurity(properties);
private void ConfigureItemSecurity(SPItemEventProperties properties)
var item=properties.ListItem;
SPSecurity.RunWithElevatedPrivileges(delegate()
using (SPSite site = new SPSite(properties.SiteId))
using (SPWeb oWeb = site.OpenWeb())
item.ParentList.BreakRoleInheritance(true);
oWeb.AllowUnsafeUpdates = true;
var guestRole = oWeb.RoleDefinitions.GetByType(SPRoleType.Reader);
var editRole = oWeb.RoleDefinitions.GetByType(SPRoleType.Editor);
SPGroup HRGroup = oWeb.SiteGroups.Cast<SPGroup>().AsQueryable().FirstOrDefault(g => g.LoginName=="HR Team");
SPRoleAssignment groupRoleAssignment = new SPRoleAssignment(HRGroup);
groupRoleAssignment.RoleDefinitionBindings.Add(guestRole);
SPUserCollection users = oWeb.Users;
SPFieldUserValueCollection hm = (SPFieldUserValueCollection)item["HiringManager"];
SPFieldUserValueCollection pm = (SPFieldUserValueCollection)item["ProjectManager"];
SPFieldUserValueCollection pmChiefs = (SPFieldUserValueCollection)item["ProjectManagerChief"];
item.BreakRoleInheritance(true);
item.RoleAssignments.Add(groupRoleAssignment);
foreach (SPFieldUserValue staffMember in hm)
SetRightsOnItem(item, staffMember, editRole);
foreach (SPFieldUserValue staffMember in pm)
SetRightsOnItem(item, staffMember, guestRole);
foreach (SPFieldUserValue staffMember in pmChiefs)
SetRightsOnItem(item, staffMember, guestRole);
item.Update();
private void SetRightsOnItem(SPListItem item, SPFieldUserValue staffMember, SPRoleDefinition role)
SPUser employeeUser = staffMember.User;
var userRoleAssignment = new SPRoleAssignment(employeeUser);
userRoleAssignment.RoleDefinitionBindings.Add(role);
item.RoleAssignments.Add(userRoleAssignment);
Nothing is happening though... Is the event handler the right place to do this?
thank you

Hi ,
You can refer to the code working in my environment:
using System;
using System.Security.Permissions;
using Microsoft.SharePoint;
using Microsoft.SharePoint.Utilities;
using Microsoft.SharePoint.Workflow;
namespace ItemLevelSecurity.ItemSecurity
/// <summary>
/// List Item Events
/// </summary>
public class ItemSecurity : SPItemEventReceiver
/// <summary>
/// An item was added.
/// </summary>
public override void ItemAdded(SPItemEventProperties properties)
SPSecurity.RunWithElevatedPrivileges(delegate()
try
using (SPSite oSPSite = new SPSite(properties.SiteId))
using (SPWeb oSPWeb = oSPSite.OpenWeb(properties.RelativeWebUrl))
//get the list item that was created
SPListItem item = oSPWeb.Lists[properties.ListId].GetItemById(properties.ListItem.ID);
//get the author user who created the item
SPFieldUserValue valAuthor = new SPFieldUserValue(properties.Web, item["Created By"].ToString());
SPUser oAuthor = valAuthor.User;
//assign read permission to item author
AssignPermissionsToItem(item,oAuthor,SPRoleType.Reader);
//update the item
item.Update();
base.ItemAdded(properties);
catch (Exception ex)
properties.ErrorMessage = ex.Message; properties.Status = SPEventReceiverStatus.CancelWithError;
properties.Cancel = true;
public static void AssignPermissionsToItem(SPListItem item, SPPrincipal obj, SPRoleType roleType)
if (!item.HasUniqueRoleAssignments)
item.BreakRoleInheritance(false, true);
SPRoleAssignment roleAssignment = new SPRoleAssignment(obj);
SPRoleDefinition roleDefinition = item.Web.RoleDefinitions.GetByType(roleType);
roleAssignment.RoleDefinitionBindings.Add(roleDefinition);
item.RoleAssignments.Add(roleAssignment);
Thanks,
Eric
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected].
Eric Tao
TechNet Community Support

Workflow for Changing Item Level Permission in SharePoint 2013 (Office365)

I am using OOTB Tasks List in SharePoint 2013 (O365). Now my scenario is like this:
I have two user groups: 1.Sales Managers 2. Sales Executives
Sales Managers can create & assign task to Executive. I want something like Sales Managers Can view all tasks (Which is by default view of tasks list i.e. perfact) but Executives can see only their tasks assigned to them. How can I achive this?
Can I use WorkFlow for this to Change item level permission or to assign permission to assigned to user? or JS
Can anyone have proper solution? thanks

1. make 2 SharePoint group 1>Sales Managers 2>Sales Executives
2. Show 2 WP of same task list in same page.
3. Use Audience Target for Sales Managers Sharepoint group in first Webpart property. (All
Iten view)
4. Show "My Task" view (assign to =[Me]) Bottom WP for same task list and use Audience Target for Sales Executives. Or if you want it to see
Sales Managers as well, the dont use any Audience Target.
Bottom line - SharePoint group use in Audience Target will do the trick. OOTB
Regards Sudip Misra [email protected] +1-412-237-5435 Pittsburgh, PA

Item level permission on workflow task List using sharepoint designer 2013

Hello All,
I have created a custom approval workflow. Workflow create a Task in Tasks List. Now suppose A task is assign to user1.
User2 should not able to edit\approve\reject the item.
How to give item level permission using SharePoint designer in SharePoint 2013 workflow.
SharePoint 2013 workflow doesn't have impersonation steps also.
Please suggest how to give permission on task list based on assigned To field.

In order to change permissions on a list item you'd need a sharepoint 2010 workflow according to http://msdn.microsoft.com/en-us/library/jj728659.aspx
Unfortunately this functionality is not available in SharePoint 2013 workflows :-(
The impersonation step still exists, but it is now called "App Step" in the SharePoint Designer 2013 Ribbon. This step is disabled, though, until you activate a web site feature called "Workflows can use app permissions"

Real World Item Level Permission Performance?

I am considering implementing item level permission on a list we use. I've seen all the articles online cautioning not to do this with lists of more than 1000 items, but the articles seem to have little detailed information about the actual impact and what
causes the performance issues. Additionally, they seem to refer to document libraries more than lists. I'd like some feedback about what might occur if we were to use item level security in our situation.
Our situation is this: list of current ~700 items in a sharepoint list. Expected to grow around 700 items per year. The list has about 75 fields on it. We have 8 active-directory groups that have access to the list, based upon company department. Each
item in the list can apply to one or more departments. The groups represent around 100-150 different unique users.
We would like to use item level security to be set via workflow, to enable particular groups to access the item based upon their group membership. For example, if the list item is for the HR department, then the HR group has access. If the item is for IT,
then the IT group has access (and HR wouldn't).
That's it. There would be no nesting of items with multiple permission levels, no use of user-level ACLs on the items, etc.
Thoughts about this configuration and expected performance issues? Thanks for any feedback!

Just an update for anyone who finds this thread:
I converted our data into a test SharePoint list with 1500 rows. I then enabled full item-level security, with restrictions to hide data not created by the person.
I then set individual permissions for each item that included 2-3 AD groups with different permissions--contribute, full ownership, etc, and 2-3 individuals with varying permissions. The individuals represented around 50 total people.
After the permissions were set I then did a comparison of loading individual views and the full data set in Standard and Datasheet views, for both myself as an administrator with full list access and with several of the individuals who only had access to
their designated items--typically 75-100 of the total list.
The results were that I found no discernable difference in system performance from the user interface level while loading list views after the item level security was configured in this way. I understand this will vary based up
hardware configuration and exact permission configuration, but in our situation the impact of item level security on a list of 1500 items had very little, if any, negative performance impact. Note that I didn't check performance at the database server level,
but I'm assuming the impact there was minimal since the front-end user experience was unaffected.
I expect we'll put this solution into place and if we do I'll update this post when we have additional real-world usage information.

Item Level Permission does not work as designed

Here is the problem.
We have a site with a site members group with created permission level called vnContributor that differs from contributor in that they cannot edit delete items or versions, or create alerts.
We have a site owners group who have a custom permission level called vnOwner that allows them to add, edit, delete, view, and open items and view versions. They do not have "Manage Lists"
The list permission settings were set to view everyone and edit everyone. In this setting, however members could not see or edit anything, and owners could see and edit everything, regardless of whether it was theirs or not.
So I changed the list permissions level to edit only their own and changed the members to the OOTB contributor permission level. I then opened the calendar and added a new item as a user in the members group.
There was no change. Members still could not edit their items. Owners could see and edit everyone's items.
This is not how this is advertised to work.
ERJ MCSD MCDBA

On June 11, 2008 Rachel.lane entered the following request
"I would like to hide/show the edit button on a list item's edit form based on whether the user is the item's creator. The reason I want to do this is because SharePoint's out-of-the-box behaviour is such that when a user edits someone
else's item, the Access Denied page pops up AFTER the user makes his/her edits and presses ok.
" My users want the edit button to be hidden so they don't have to go through the steps of making the edits, press ok, and then find out their access is denied."
My users want the same thing.
Alex Santos1 said that "One approach is to give each list item it's own permission- giving the owner (creator) full access while giving everyone else read access."
However everything I seen about giving item level permission seems to utilize the method I've already been doing which does not hide the Edit button. Does anyone know how to pull off what he was suggesting?
ERJ MCSD MCDBA

Item Level permission issue

Hi,
I have created a custom list for which I have added some users with contribute permissions(The users are not given access at site level). Each user creates only a single item about himself. He should be restricted from accessing other list items in
terms of editing/deleting the list items.
Can you please help me in this regard.
Regards,
Chaitanya.

Hello Chaitanya,
You need to setup the item level permission from list settings-->advanced settings--> see below screen.
After this user will be able to edit/view only own items.
Hemendra:Yesterday is just a memory,Tomorrow we may never see
Please remember to mark the replies as answers if they help and unmark them if they provide no help

Get the item level permission in sharepoint 2013 uisng rest api

I created the test list and i created the 5 items in that list.
I stopped the item level permissions.
I shared the list item with userA.
In the rest api response, it giving the other users also (means user who is not having permission to the item).
I am using below rest query
/_api/Web/GetFileByServerRelativeUrl('/site/Lists/test/1_.000')?$expand=Versions,Author,ModifiedBy,ListItemAllFields/RoleAssignments/Member/Users,ListItemAllFields/FieldValuesAsText,ListItemAllFields/ParentList

Hi,
Following are the steps, I performed:
After adding the item in the list, I went into list item permissions and clicked on stop item permissions. Then I selected all the permissions which got carried over to the item and clicked on "Remove user permissions" in the ribbon. After that
I clicked on Grant permissions in the ribbon and shared the item with one user. Note that last action can also be performed by going back into the list and selecting the item and click on Share.
Finally, I ran the above REST query and returned the user with whom the item was selected and also the system account (which is expected, as admin will have access.
You can try shortening your query as well
/_api/Web/GetFileByServerRelativeUrl('/site/Lists/test/1_.000')?$expand=ListItemAllFields/RoleAssignments/Member/Users
This will return the relevant user permissions and response will contain lesser data and hence will be easier to read. Lastly, try intercepting the traffic
using fiddler, as again it will in reading the response.
Thanks,
Nadeem
Please remember to up-vote or mark the reply as answer if you find it helpful.

Problem with setting Item level permissions lists

Hello!
I have SPS 2013 on-premised environment with AD authentication.
At some moment I've noticed that we have a problem with setting the item level permissions on any lists except the document libraries.
When I click the "shared with" button I see a popup form with a list of users who have an access to that list but there is no "invite people" link or "Advanced" link. Moreover, the "loading" ring rotates
instanly like some operation was'nt ended.
The same operation with documents in libraries works well.
I am be grateful for any help!

Hi Mischael,
From your description, my understanding is that there were no "invite people" or "Advanced" link when some users clicked "shared with" button in some lists.
This issue seems like about permissions. Please log on your site with site collection administrator or a user who has full control for the site, then go to a problematic list->List settings->Permissions for this list, check whether the list
has unique permissions. Then click "Check Permissions", check the permission level for the problematic users and then go to Site Settings->Site permissions->Permission levels, check whether the permission level contains "Manage permissions".
If not, add the permission into the permission level.
Thanks,
Wendy
TechNet Community Support
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
[email protected]

Workflows: How to send email to item level permission groups

I used SharePoint Designer 2010 to create an impersonation workflow which changes (reduces) item level permissions to the item creator and 1-2 other Active Directory groups when an document is added to the library. There are about 26 permission combinations
which are based on the document's properties. So far, everything seems to be working correctly.
My question: is it possible to send a reminder email to the item level creator and group(s) - EG 7 days after the item was added? Would this be included in the impersonation workflow or could it be performed in a separate workflow?
In advance, thanks for suggestions!

Hello,
You can include the email notification in same email to send only one after 7 days. Use Pause for action and you can define the condition when you want to send email if any.
If you want to send continuously reminder email after some period then you also need to create one more small WF with one condition which will hit first WF continuously until you meet your expectation.
http://sharepoint713.blogspot.in/2011/09/sharepoint-designer-workflow-to-send.html
http://www.smellslikesharepoint.com/2012/06/26/sharepoint-2010-workflow-pause-until-date-and-time/
Hope it could help
Hemendra:Yesterday is just a memory,Tomorrow we may never see
Please remember to mark the replies as answers if they help and unmark them if they provide no help

SharePoint Item level permission is not been carrying to Folder and Library permission SharePoint 2013

Good Day
I have a document library with multiple folders containing documents.
Security "Group A" views all content.
Security "Group B" gets granted permission from the users in Group A by running a workflow.
Problem:
When users in "group A" runs the workflow on the document level the permission is not carried to the folder and library level.
So users in "Group B" are unable to view the folder or library in which the document is located.
Thanks

We have found that many unneeded mistakes are made when dealing with SharePoint permissions. As a result we created a Data Room product for SharePoint Online and SharePoint 2013
that allows users to easily share, track and analyze files and greatly simplifies permissions in SharePoint.
Take a look, we are offering it free for 6 months.
http://www.codeasite.com/index.php/CAS-Data-Room

Item level update security in MS SharePoint 2007

Hi,
I am working on a requirement where restriction to update list items need to be made at row level. E.g. based on the data in the column of a row, the row will be available for editing to some users. I am looking for an approach to implement this requirement
in MS SharePoint 2007. Any help in this regards will be appreciated.

The easiest way to do this is to set individual item permissions using an event receiver when the item is added or saved. I did an example of this in a BLOG post a while ago. Here's the post.
http://www.dontpapanic.com/blog/?p=25
The example sets item level security based on the content type, but you can change the logic to whatever you like. One Note: This solution will not scale for use in a really large list. There is a limit on how many individual ACLs you can
have in a list. For 2007 I think it was 2,000.
Paul Stork SharePoint Server MVP
Principal Architect: Blue Chip Consulting Group
Blog: http://dontpapanic.com/blog
Twitter: Follow @pstork
Please remember to mark your question as "answered" if this solves your problem.

Item-level Permissions availabe in list advance setting not working.

Hi,
Recently i had an requirement of maintaining item level permission. My requirement was that whenever an item is created in list, it should be created with uniqure permission. I know how to do it by writing
custom code, but i don't want to do it with any code as client doesn't need any dll etc. After explroring i found that there is an option available in List's advance setting. Following are the steps i followed:-
Go to List settting.
Go to Advance setting.
In advance setting we have "Item-level Permissions" as one of option. This option have two
sub options.
For Read Accesss
select "Read items that were created by the user"
For Create and Edit access select "Create items and edit items that were created by the user"
Save the above settings.
Below is the screen shot for above mentioned setting:
Expected behaviour from above setting are:
Users can create new items
User can view and edit items only those item that are created by them.
But i found there is not change in item level permission. All users can View and
Edit items created by other users. May i am
misunderstanding above setting or there is Bug in sharepoint. Please help me if any body have any idea about it.
Regards,
Deepak
Deepak Kejriwal

Make sure that users have "Contribute" permission to the list, if the users have more permission at site level, then the list permission will be overridden by site permission.
Refer the following article for more info.
http://office.microsoft.com/en-us/windows-sharepoint-services-help/permission-levels-and-permissions-HA010100149.aspx
--Cheers

Sharepoint 2007 Setting Item level permission

Similar Messages

Maybe you are looking for