Item Level Permission - SPD Workflow 2013 - Part 2

Workflow Creation & Configuration

Full Workflow Screenshot

1.  Below is the screenshot of the workflow that we would be developing.
2. 
   
   

Create a SPD 2013 Workflow

1. Create a SharePoint Designer workflow for “Demo List”. 
2. Since SharePoint Designer workflow runs under current user authorizations so we will not be able to call REST API under normal user credentials. So we will have to user APP STEP.

Enable App Step

1. APP Step is a new feature in SharePoint Designer Workflow. We have to assign permission to workflow just like we do for SharePoint Apps and workflow would be able to do the task even if user is not having access for that action.
2. By default APP STEP action would be disabled.
3. To enable that we need to active a site feature “Workflow can use App Step”.
4. Activate the above mentioned feature.
5. After activating you would see, app step action is activated in SharePoint Designer as show below
   

Assign Permissions to Workflow

1. Go to Site Settings à Site App Permissions
2. Now publish a blank workflow and again go to Site Settings à Site App Permission.
3. You will see new entry for Workflow.
4. Underlined text would be the APP ID for which we need to give Full Control to web level. Copy this APP-ID.
5. Go to  https://sponlinepractice.sharepoint.com/sites/ml/_layouts/15/appinv.aspx
6. Paste the APP-ID copied in previous step in above form and click on Lookup button.
7.  It will auto-populate the information such as Title, App Domain, Redirect URL.
8. Now copy paste below permission xml in Permission Request XML in above form.
   
9. Here we are giving full control to workflow at web level which is defined by scope and Right in above xml.
10. Click on create.
11. It will ask you to trust the workflow access. 
12. Click on trust.
13. Now workflow has enough permission to call REST API and assign proper permissions

                               Proceed to Part 3

Item level Permission - SPD Workflow 2013 - Part 1

Follow below steps to apply item level permission in SharePoint Online using SharePoint Designer Workflow.

Scenario: If an employee visits some other location for officially then expenses would be reimbursed but for that there would be an approval cycle. Once employee submits the expenses then it would be approved by Manager. For that we will follow below steps.

REST API’s to be used

	URL	Method Type
Break Role Inheritance	/_api/web/lists/getByTitle('User Access Requests List')/items(itemId)/breakroleinheritance(copyRoleAssignments=false, clearSubscopes=true)	POST
Add Permission of user	/_api/web/lists/getByTitle('User Access Requests List')/items(itemId)/roleassignments/addroleassignment(principalid=UserId,roleDefId=rId)	POST
Remove Permission of User	/_api/web/lists/getByTitle('User Access Requests List')/items(itemId)/roleassignments/getbyprincipalid(userId)	DELETE

List Creation

•   Create a list: I have a demo list namely “Demo List” and with few columns.

Column Name	Type
Title	Single Line of Text
Location Visited	Single Line of Text
Expenses	Number
Manager	User
Status	Choice

•      Status field would be having below options.

a.       Pending with Manager  - Default value

b.      Closed

Proceed To Part 2

Get SharePoint Role Definition IDs (Out of the box + Custom Permission set)

To assign item level permission we need to have the role definition ids. Here are few out of the box ids below.

Role Definition Name	Role Definition Id
Full Control	1073741829
Design	1073741828
Edit	1073741830
Contribute	1073741827
Read	1073741826
View Only	1073741924

Above Role Definition IDs are found using below REST API only.

Role definition ids of custom permission set can be found out using REST API. I have created a custom permission called “BASIC USER”. Now hit below URL in the browser

https://site-url/_api/web/roledefinitions

You can see the custom permission details including Role Definition ID in the browser response as in below screenshot. I am using online xml beautifier tool for good visibility. It will show role definition ids of all the permission sets (out of the box permissions like full control, read etc as well as custom permissions)

SharePoint Designer workflow triggering multiple emails.

I had a list containing 8 people picker columns with allow multiple values set to true. It was having out of the box forms. Whenever user submits an item it sends an email to all the users marked in all the people picker fields. SharePoint Designer workflow was used to send email to users. Workflow was having just “send an email action”.

Issue: Users were getting n number of emails on item creation/updation.

Workflow Status: Workflow was stuck in suspended state and keeps on retrying because of retrying users were getting n number of emails.

Reason: For an item is number of total users in all people picker column reaches approx. 30 or more and where few duplicate users are added in multiple fields. Then the “send an email” action tends to go to suspended state and keeps on sending emails to users marked in people picker column until the workflow is terminated.

Solution: There should not be repeated users in multiple people picker fields. For ex. User1 Should not be present in Field1 & Field2 simultaneously.  For that you can add a client side validation before item submission notifying the users whenever there are any repetition of users.