Jun 23, 2015

Another method to prevent certain users from viewing some documents or items is to directly apply permissions on the items themselves. Item level permission overrides list/library level permissions; therefore even if a certain group has 'Edit' permissions on the document library, imposing 'Read' permission on a document will remove the 'Edit' permission from that document for that group.

We can automate the application of file level permissions using a workflow. The workflow applies corresponding permissions on the fly as you upload the document.

To design the workflow we need SharePoint Designer. If you don’t have it, you can download it free from Microsoft site. In SharePoint Designer, select 'Workflows' from the 'Navigation' pane and from the tab, click on 'List Workflow' and select your list. Now name you workflow something, call it 'Set Permissions Workflow.' You’ll see an empty canvas with Step 1 box.

1. Click outside below Step 1 box and select 'Impersonation Step' from the ribbon and then delete Step 1 (click on the Step 1 title and press delete on the keyboard).
2. Click inside 'Impersonation Step' to show an orange line and then from 'Action,' select 'Replace List Item Permissions.'
3. Click on 'These permissions' and then click on 'Add…'. Click on the 'Choose…' button and select the appropriate group. One of the useful groups that you may want to choose is 'User Who Created Current Item' then click OK.
4. Select the permissions to grant to the group. I selected 'Contribute permission' and then click OK.
5. You can now add more groups and permissions by clicking on the 'Add…' button again. Once you are done, click on OK.
6. Click on the blue text 'This list' and select 'Current Item' (which should already be selected).
7. From the tab click on the Workflow Settings icon and tick next to 'Start workflow automatically when an item is created.' Click on Publish.

Mission accomplished. Any new item that is created in or uploaded to the list will have these permissions automatically set.