Approval status can be modified only by relevant Approval

%3CLINGO-SUB%20id%3D%22lingo-sub-821290%22%20slang%3D%22en-US%22%3EApproval%20status%20can%20be%20modified%20only%20by%20relevant%20Approval%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-821290%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20a%20SharePoint%20list%2C%20where%20I%20will%20store%20some%20data.%3C%2FP%3E%3CP%3EWhen%20new%20entry%20will%20be%20recorded%2C%20I%20will%20have%203%20different%20Approvers.%3C%2FP%3E%3CP%3EFor%203%20Approvers%20I%20will%20have%20relevant%20%221st%20Approver%20Status%22%2C%20%222nd%20Approver%20Status%22...%20columns%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20any%20way%20to%20limit%20these%20columns%2C%20so%20only%20relevant%20Approver%20can%20modify%20his%20column%20of%20%22Approver%20Status%22%20in%20SharePoint%20list%3F%3C%2FP%3E%3CP%3EI%20am%20integrating%20Approval%20with%20Microsoft%20Flow.%20(send%20to%201st%20approver%2C%20then%20to%202nd%2C%20then%20to...)%3C%2FP%3E%3CP%3EAnd%20I%20will%20need%20strong%20evidence%2C%20that%20nobody%20except%20relevant%20Approver%20can%20change%20the%20status%20of%20the%20new%20entry%20in%20SharePoint%20list.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20this%20no%20possible%2C%20is%20there%20any%20possibilities%20to%20track%2C%20that%20relevant%20Approver%20approved%20request%20from%20his%20side%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-821290%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ELists%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EPermissions%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESharePoint%20Online%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-821425%22%20slang%3D%22en-US%22%3ERe%3A%20Approval%20status%20can%20be%20modified%20only%20by%20relevant%20Approval%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-821425%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F397776%22%20target%3D%22_blank%22%3E%40Salauat%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EUnfortunately%2C%20There%20is%20no%20way%20to%20set%20the%20permission%20at%20column%20level.%3C%2FP%3E%3CP%3EYou%20can%20create%20a%20custom%20view%20and%20create%20a%20filtering%20per%20column%20but%20they%20can%20switch%20between%20the%20views.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-821832%22%20slang%3D%22en-US%22%3ERe%3A%20Approval%20status%20can%20be%20modified%20only%20by%20relevant%20Approval%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-821832%22%20slang%3D%22en-US%22%3EAs%20Alireza%20points%20out%20you%20can%20not%20secure%20this.%20There%20are%20ways%20to%20create%20security%20by%20obscurity%20but%20it%E2%80%99s%20not%20true%20security.%20%3CBR%20%2F%3E%3CBR%20%2F%3EAs%20far%20as%20logging.%20Version%20history%20is%20in%20and%20if%20these%20documents%20sit%20and%20don%E2%80%99t%20get%20modified%20much%20your%20version%20history%20will%20show%20The%20Who%20modifies%20what%20columns.%20You%20can%20use%20this%20as%20some%20what%20if%20an%20audit.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-822828%22%20slang%3D%22en-US%22%3ERe%3A%20Approval%20status%20can%20be%20modified%20only%20by%20relevant%20Approval%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-822828%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F397776%22%20target%3D%22_blank%22%3E%40Salauat%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou'll%20want%20to%20look%20at%20content%20approval.%20This%20is%20a%20list%20setting%20independent%20from%20Flow%2C%20but%20I%20believe%20can%20be%20accessed%2Factivated%20using%20Flow.%20With%20content%20approval%20all%20new%20items%20are%20pending%20until%20a%20designated%20approver%20(someone%20in%20a%20permission%20group%20with%20Approver%20level%20access%20or%20higher)%20approves%20the%20item.%20The%20approver%20will%20be%20listed%20in%20the%20Modified%20By%20column.%20After%20that%20point%2C%20if%20anyone%20edits%20an%20item%2C%20it%20will%20revert%20back%20to%20pending.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EContent%20approval%20uses%20a%20system%20field%20to%20track%20approvals%2C%20not%20the%20custom%20field%20you%20created%20so%20you%20can%20delete%20those.%20Unlike%20your%20custom%20fields%20that%20can%20be%20edited%20by%20anyone%20with%20access%2C%20these%20system%20fields%20cannot%20be%20edited%20directly%20by%20anyone%20regardless%20of%20permission%20level.%26nbsp%3B%20If%20it%20says%20%22Approved%22%2C%20that%20means%20the%20person%20in%20the%20Modified%20By%20column%20did%20it.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20don't%20believe%20you%20can%20prevent%20people%20from%20editing%20the%20items%20even%20after%20approval%2C%20however%20when%20they%20do%2C%20the%20item%20loses%20Approved%20status%20and%20would%20need%20to%20be%20re-approved%20by%20a%20designated%20person.%26nbsp%3B%20That's%20about%20as%20locked%20down%20as%20you%20can%20make%20it.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Visitor

I have a SharePoint list, where I will store some data.

When new entry will be recorded, I will have 3 different Approvers.

For 3 Approvers I will have relevant "1st Approver Status", "2nd Approver Status"... columns

 

Is there any way to limit these columns, so only relevant Approver can modify his column of "Approver Status" in SharePoint list?

I am integrating Approval with Microsoft Flow. (send to 1st approver, then to 2nd, then to...)

And I will need strong evidence, that nobody except relevant Approver can change the status of the new entry in SharePoint list.

 

If this no possible, is there any possibilities to track, that relevant Approver approved request from his side?

3 Replies
Highlighted

@Salauat 

Unfortunately, There is no way to set the permission at column level.

You can create a custom view and create a filtering per column but they can switch between the views.

 

 

Highlighted
As Alireza points out you can not secure this. There are ways to create security by obscurity but it’s not true security.

As far as logging. Version history is in and if these documents sit and don’t get modified much your version history will show The Who modifies what columns. You can use this as some what if an audit.
Highlighted

@Salauat 

 

You'll want to look at content approval. This is a list setting independent from Flow, but I believe can be accessed/activated using Flow. With content approval all new items are pending until a designated approver (someone in a permission group with Approver level access or higher) approves the item. The approver will be listed in the Modified By column. After that point, if anyone edits an item, it will revert back to pending.

 

Content approval uses a system field to track approvals, not the custom field you created so you can delete those. Unlike your custom fields that can be edited by anyone with access, these system fields cannot be edited directly by anyone regardless of permission level.  If it says "Approved", that means the person in the Modified By column did it.

 

I don't believe you can prevent people from editing the items even after approval, however when they do, the item loses Approved status and would need to be re-approved by a designated person.  That's about as locked down as you can make it.