Forum Discussion

Gti182's avatar
Gti182
Copper Contributor
Nov 03, 2023

Sharepoint lists question on permission setting vs. custom user views and risks

Hi All,

 

I'm setting up a sharepoint list to be used by a many people in an organisation > 50. The list will contain sensitive information so it's crucial only specific people see specific items in the list which may contain over 1000 rows of data.

 

The requirements are that anyone who creates an item (e.g. Peter) should be able to view/edit their item together with their manager (e.g. Simon) plus anyone else they decide to allow access to (e.g. Paul). 

 

I've looked into item level permissions but found it quite restrictive for how the users would need to use the list. Also given that some of the data might be prepopulated on behalf of users from a starting point so they would not always be the person that created the item. Below item level permissions would not allow manager Simon or additional user Paul to see the item as they didn't create it. Peter would only be able to see his items if he created them but not if an Admin created items on his behalf.

 

I've managed to get the list to work how I'd like by setting a custom view whereby the user would populate 2 person columns, Column A (Assigned To) and Column B (Manager). By adding Peter and Paul into column A and Simon to Column B I've updated the settings to show only items where their names specifically appear in either the Assigned To or Manager fields. Permissions are then set that users can't un-filter the view.

 

Now my question is, is this a safe way of allowing users to view and edit their items only based on their name being in either column A or B or is there a risk that other users might be able to see the whole list? Are there any other things to consider with such a list?

 

many thanks!

  • Kelly_Edinger's avatar
    Kelly_Edinger
    Bronze Contributor
    You'll need to ensure that the List itself is no longer inheriting permissions from the parent (the site), remove members and visitors access, and then uniquely share each list item (use the inline share button for the list item). This is tedious and prone to errors and lots of help desk tickets but anyone who knows how to change the view from 'me' to 'all' will see all items.
    • Gti182's avatar
      Gti182
      Copper Contributor

      Thanks Kelly, That does sound painful.

      If the permissions are set correctly for the views that users only have "edit" level access would they then not have the option to view all items?

       

      I've been playing around with the audience targeting field, it looks to be a possible solution by adding user names into the field it allows only them to see those items. Just wondering if there are possible risks option too?

       

Resources