Hierarchy based structure and accordingly setting permissions

[Sidhant_02]

Hi everyone,
I had a requirement that was related to security access (permission access).  I will provide an example for better understanding:

Example:

User 1 (U1)	Team Lead 1	Manager 1
User 2 (U2)	Team Lead 1	Manger 1 (M1)
User 3 (U3)	Team Lead 2 (TL2)	Manager 2 (M2)

Here User1 and User2 are under TeamLead1 so TeamLead1 should be able to view his/her record along with that they can access the two users records that are under them and similarly Manager1 will be able to access his/her record as well records of TL1, U1,U2.

Manager2 will only be to access TeamLead2 and User3 records and won't be able to access/view other records (that includes U1,U2,TL1,M1) same is the case for Manager1 and TeamLead1.

So as of now what I have done is implemented 2 scenarios which include the Admin side (where they will have the complete control no restriction i.e. Individuals with admin role will be able to access all the records) and the other part is Employee (wherein any employee will only be able to edit/view only those records that they have created, other records will not be accessible).
To achieve this I have made use of Item-level permissions that is provided by SP and selected the following:

And to manage the access have created a flow (which won't affect admin access)

Current admin view: (As mentioned Admin will be able to access all records)

For a Employee/User:

So if anyone has any idea's or has implemented it before please do let me know, it will be helpful. 

Regards,
Sidhant.

[BCBuizer · Accepted solution]

Hi @Sidhant_02 ,

If I understand correctly, you are asking how to grant read access to the Team Lead and their managers to the records as created by the users.

To grant them access, first you need to get the data as to who is the Users' Team Lead. In case this is set in Entra ID (formerly known as Azure Active Directory), you can simple use a "Get Manager V2" action (https://learn.microsoft.com/en-us/connectors/office365users/#get-manager-(v2)) to get the data and then either add that to the existing "Grant accessto an item or file" action if you want them to be able to edit the data, or add a second instance of the same action that only sets "Can View" permissions.

The same can then be applied for the manager where you use the outputs of the first "Get Manager V2" action to retrieve the manager of the team lead.

In case you don't have the hierarchy data in Entra ID, please share how you do have this stored.

[Sidhant_02]

Hi @BCBuizer ,
Thanks for the reply currently in the azure AD the manager name is not set so for the time being what I did was added a column in the Sharepoint list named (Manager: Type - Person) and then used it Grant item access like:

(I had created this record in which I had assigned it to two other user). So I was expecting after the above change in flow the manager (here Sushant: should be able to see the record in his app) instead it only displayed 1 record (that was created by him)

The list settings are:

As a creator of the new task I am able to see the new task (which is obvious but whom to the task is assigned to and the manager should also be able to view that)

This is the successful flow run:

(Here there are two emails: one for creator which is me in this case and the other one is manager email: here it is Sushant - for whom this item is not visible yet)

Am I missing anything?

Regards,
Sidhant.

[BCBuizer]

Hi @Sidhant_02 ,

First of all, this flow overrides the default behaviour of the SharePoint list Item-Level permissions, so those are not relevant.

Second, since the flow ran correctly, the manager should now have access, but this will require the data source to be refreshed in any app sessions the manager may be running. If you want to explicitly verify if the manager has access, go to the SharePoint UI and check the sharing settings for the item the flow was applied to.

[Sidhant_02]

Hi @BCBuizer ,
Ok so what I understand the Manager should have the access and should be able to view the record (here its Sushant for the item: Security) so how can they refresh the data-source at their end and I did check for the item-level for that specific record and it looked like:

Regards,
Sidhant.

[Sidhant_02]

Hi @BCBuizer,
As I did resetting the item-level permission to default (as they were earlier and then made some changes) but in that case the user was able to see almost all records 

This is the actual list:

For the user (lets consider Sushant) should be able to see three records which are 'Sample' (that he created), PL-900 certification (i.e. assigned to - only view rights) and L1 level record (where he is Manager so he can edit that)

Instead he is only able to see the record that was created by him:

The flow has executed successfully.

When I checked for permissions at SP level:

For PL-900 certification the user (Sushant is Assigned to: so he should have the view access)

What's missing here?

Regards,
Sidhant.

[BCBuizer]

Hello @Sidhant_02 ,

I'm having a real hard time understanding what is happening without you sharing what changes you made to the flow:

If Sushant created the item, he should have a "Can Edit" role, right? And since for the PL-900 no manager was included, there shouldn't be anyone with a "Can View" role, right? 

[Sidhant_02 · Accepted solution]

Hi @BCBuizer ,
Just a quick update, I tried one more approach wherein I set the item-level settings to default which look like:

(earlier you mentioned in one of your replay that flow will override the item-level permissions that is set at list level but I assume that Item-level permissions were taking higher priority over the permission that I  was trying to set in the Power Automate flow, so even if the flow ran successfully the actual permissions that were set were not getting reflected)
 
So now when I made some changes: (For reference lets consider the same user: Sushant).

I also added another user named Rahul and made him the manager for 2 tasks (and now he was also able to get the records that we expected)

The only minor issue that I have observed for both users there is one record in common (in which both users are not assigned to nor are they are the manager.  Previously I had created this record 'Learn Power Apps' which is visible to both)
When I checked its access:

So I guess this record was created at start hence every member is able view it and can edit it.

Regards,
Sidhant.

[Sidhant_02]

Hi @BCBuizer ,
I have not made any major changes to the flow, just using the code instead of the values provided in drop-down:

This was for one of the items (level-2)

And for PL-900 item which was created by me it will be accessible to me and to the assignee.
[Which is working as expected]

Now the record 'Learn Power Apps' which is created by me and assigned to me is visible to other users, so is it because the here the creator and assignee is same? (which is me in this case)

Regards,
Sidhant 

[BCBuizer]

Hi @Sidhant_02 ,

As the name Item-level permissions implies, permissions need to be set at an item level, meaning that the flow needs to run for each item. Given that the current trigger for the flow is "When an item is created", I assume the working flow has not yet ran for the "Learn Power Apps" item, which is why the permissions are not as they should be. 

The easiest for now, since you seem to only be using sample data, is to delete the items with the wrong permissions and re-create them. After that all permissions should be set correctly.