Power Platform Community Forum Thread Details

He creado un flujo en Power Automate que se activa cuando se crea o modifica un elemento en una lista de SharePoint. El flujo comprueba si el campo "Estado Fra." es igual a "Fra. Contabilizada". Si se cumple, rompe la herencia de permisos, deja de compartir el elemento y concede acceso de edición solo a ciertos usuarios, y acceso de solo lectura a otros.

El problema es que, aunque pongo "Estado Fra." en "Fra. Contabilizada", los usuarios siguen pudiendo editar el elemento. ¿Alguien sabe por qué no se aplican correctamente los permisos?

Categories:

Power Automate Desktop

Hi @NC-26030721-0,

Your Power Automate flow is likely breaking permission inheritance but copying existing permissions, or not fully removing permissions granted via site/list groups (e.g., Members). As a result, users retain Edit rights despite the condition being met. Order and configuration of the permission actions are critical: you must break inheritance without copying, remove existing role assignments, and grant only the roles you want. Also verify there isn’t another mechanism (site membership, other flows, sharing links, or content approval/approval connectors) re‑granting Edit access.

If that is correctly translated...

Why it happens

Break inheritance with “Copy = Yes” keeps all current Editors.
Site Members/Owners group gives Edit via group membership (not removed by “Stop sharing”).
Wrong action order (granting before removing) or another flow/approval step re-adding Edit.
Trigger timing: flow runs before the field is actually saved, or multiple runs overwrite permissions.

How to fix

Trigger condition so the flow only runs when Estado Fra. equals Fra. Contabilizada:

Add a trigger condition to the SharePoint trigger to avoid race conditions.

Break inheritance without copying:

Use Break inheritance with Copy role assignments = No (very important).

Remove existing access explicitly (if needed):

If you used REST, ensure copyRoleAssignments=false and clearSubscopes=true.
Don’t rely solely on “Stop sharing”; it doesn’t remove access via site groups.

Grant only required access:

Use Grant access to an item (Read for viewers, Edit for specific editors).

Strip site group rights at item level:

Remove [Site Members] (and any custom groups with Edit) from the item’s role assignments.

Sanity checks:

Confirm users aren’t Site Owners or in a group with elevated rights.
Ensure no other flows or Approvals steps re-grant access.
Verify the flow target (correct Site Address/List/Item ID).

References:

Solved: Break SharePoint list inheritance permissions & set unique permissions from users listed in item (video)

https://www.spguides.com/break-permission-inheritance-sharepoint-online-power-automate/

https://learn.microsoft.com/en-us/sharepoint/dev/business-apps/power-automate/guidance/manage-list-item-file-permissions

https://www.c-sharpcorner.com/article/how-to-break-and-set-sharepoint-group-permissions-on-list-items-using-power-auto/

https://www.sharepointpals.com/post/break-list-item-permission-inheritance-using-power-automate/

✅ If this answer helped resolve your issue, please mark it as Accepted so it can help others with the same problem.
👍 Feel free to Like the post if you found it useful.