Set SharePoint List Item Permissions Using MS Flow

• Now to set permission, flow provides the “Grant access to an item or a folder” action. Select this action as the next step as shown in the image (fig 5).
• Now insert the same site address in position 1.
• Select the list name from the dropdown in position 2 as shown in the above image.
• Now you can insert the ID, as this is dynamic content by putting it from the dynamic content helper as position 3. You can even provide static value in this field.
• To provide permission in the List item or library file, the user or group has to have an email address, by which flow would be able to identify and provide permission. In position 4, we have to provide an email address.
• In position 5, we have to provide the “Role” which will identify the permission level. In this box, two options have been given as dropdowns which are “Can edit” and “Can view”. We can select one of these options. We can also provide a custom value which needs to be a valid value.
• If we want to add a custom value, we have to provide the Role Definition ID of the permission levels that we want to permit for the user.
• If we want to notify the user about this given permission, then select “Yes” in position 7 and put your message in the message box in position 6.
• For this demo, we are not notifying the user, so we have selected “No” in position 7.

Set permissions for SharePoint Group

With this provided action “Grant access to an item or a folder” in MS flow, we can’t change the permissions of the SP group. Because this action could only recognize the user/group who have an AD email address. As the SP group doesn’t have any, we can change permission for the SP group with this action. To change permission for the SharePoint group, we have to call the REST API endpoint for role assignment. We will use the following rest api to change the permission of the SP group.

_api/web/lists/getbytitle('<List Name>')/items(<List Item ID>)/roleassignments/addroleassignment(principalid='<Group/User’s Principle ID>',roleDefId=<Role Definition ID>)

From the above rest api, we have to change the red marked portion with the respective value. The details are given below.

Fig 6. Action – Send an HTTP request to SharePoint

• For the next step, select a new action “Send an HTTP request to SharePoint”.
• Enter the site address in position 1.
• Select “POST” as a method in position 2.
• Put the rest of URI in position 3. Provide your specific list name and list item ID as shown in the above image. (Fig 6)
• In position 5, provide the role definition id. Each SharePoint Permission level has a specific role definition ID which you can get in detail in this article: Get SharePoint Role Definition IDs.
• We have selected the role definition ID “1073741926” which is for “Read” access.
• In position 4, we have to provide the group’s principle ID. To get the principle ID of a group, we have to get it from the site settings as described below.

Get the Group's Principle ID

Fig 7. Getting the group's Principle ID

• Go to the Site Settings page.
• Now, click on ‘People and Group’ which is under ‘Users.
• Click on the specific group’s name. Site Settings > Users and Permissions > People and groups > “Groups Name”.
• The group's page will be opened with the group members as shown in the image (fig 7).
• From this group's page, we will get the Group’s Principle ID from the page URL. As an example, on the “Tahmid Dev Members” group’s page, the URL has the parameter “MembershipGroupId” with the value ‘6’. So this group's PrinicipleID is 6.

Run the flow

• Now the flow has been completed. We can test the flow now.
• Here is the image of the full flow given below:
  
  Fig 8. Full Completed Flow
• First, save the flow. Then click in the test.
• Then create a new item in the “Test” list.
• Let’s check the item's permission as the flow hasn’t been running yet.
  
  Fig 9. Item’s Permission before running the flow
• We can see that the item is inheriting the list’s permission. And two groups have permission on this item which are Approvers and Designers.
• Now, let’s see the situation after running the flow successfully.
  .
  Fig 10. The item’s permission after running the flow
• After running the flow, the list item’s inheritance permission will be broken as shown in the image above (Fig 10).
• The User and Group, for which we provided the permission “Read”, has given as we see can see in the image.

Conclusion

As we already saw, in this approach with the provided actions we can’t grant permission for the SharePoint group. We need rest api end to point to perform that. Similarly to remove a specific user/group’s permission from an item is not achievable with these provided actions till now MS flow is providing. So, in that situation, we have to use rest API endpoints to manage the item level permission in MS flow.

I hope this article will help you. Be safe. Happy Coding.