Can anyone "When an item is created" through my SharePoint List?

(0) Share

Report

Posted on by FG-18100917-0

Hey,

I'm struggling with a good permissions setup for SharePoint Lists for a particular scenario.

Imagine a list where everyone has to be able to contribute and then their leaders have to be able to visualize the items and approve on them.

What this means is I can't have the advanced setting "Read items that were created by the user" turned on the list.

So instead I have a Flow which runs When an item is created, which takes away the Contribute permission from Everyone on the item, and replaces it with individual permissions (Contribute for Employee and their Leader).

The issue is... it takes a moment for that Flow to trigger. So there's a brief moment where a record on the list is visible to everyone.

I worked around this in terms of SharePoint List view, to limit what a person would see if they stumbled upon the list somehow, and of course with proper filtering in the Power App,
but that still leaves the possibility of someone setting up a Power Automate Flow of their own with When an item is created on the List if they learn the Site and List name, basically doing whatever they want with the data upon its creation.

I'm trying to think of a way of making this work WITHOUT having to turn on the advanced setting and having to keep the approval separate on a different list... (or using the Approvals functionality in Power Automate, as I find it not flexible enough).

Anyone?

Categories:

Security

I have the same question (0)

All responses (2)

Answers (0)

Suggested answer

SaiRT14 1,990 Super User 2025 Season 1 on at

Like (0)

Report
Copy link

Link copied!
Instead of relying solely on a Power Automate Flow to adjust permissions post-creation, you can modify how SharePoint handles item-level permissions:

Break Inheritance on the List Level: Break the permission inheritance on the list level and set default permissions for everyone to "Add" items only. This would allow users to add new items but not view or edit any items, including their own, until the Flow updates permissions.

Contribute with "Add Only" Permission Level: You can create a custom permission level by adjusting the "Contribute" permissions to allow only "Add Items." This way, employees can still create entries, but they won't have visibility over any items in the list.

Change Permissions in Flow: After an item is created, your Flow would still run to assign the appropriate permissions for the employee and their leader to view and approve the items.

To prevent unauthorized users from accessing the list while awaiting permission updates, consider the following:

Limit Permissions on the Entire List: Instead of allowing broad read access, limit the permissions on the list so only specific views (e.g., filtered views based on permissions) are available. This helps prevent users from creating custom Power Automate Flows that might manipulate items while permissions are being adjusted.

Predefined Views and Filters: In your Power App or SharePoint views, apply filters that limit visibility to only those items where the user is either the creator or their leader. Even though the permissions update with a delay, the filtering can still minimize exposure in the interim.

Was this reply helpful? Yes No
FG-18100917-0 10 on at

Like (0)

Report
Copy link

Link copied!

@SaiRT14

It would be cool to be able to create an "Add Only" permission level, but it's not.

Is your response AI-generated?

Was this reply helpful? Yes No