Remove Specific User Access to a SharePoint List Item

[Gottijay2000]

I have item level permissions set up on SharePoint List, but i would like the ability to remove specific user access to some items. i'm seeing alot of information around adding users but nothing on removing users.

Any one have an idea on how to achieve this please?

[sudharsan1985]

Hi @Gottijay2000 

You can try using 'Send Http request to SharePoint' using the REST API to change the permission of an item.

[Gottijay2000]

 @sudharsan1985 do you know what endpoint would do the trick?

[sudharsan1985]

Hi @Gottijay2000 

Please refer the below links.

https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/set-custom-permissions-on-a-list-by-using...

https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/get-to-know-the-sharepoint-rest-service?t...

[Gottijay2000]

@sudharsan1985 none of the links have what i'm looking for which is the ability to remove a user from an item that has item level permissions

[sudharsan1985 · Accepted solution]

Hi @Gottijay2000 

To modify the item permission,

1. You have to break the inheritance from the parent which can be done using the below endpoint

_api/web/lists/getByTitle(<List Title>)/items/getById(<Item id>)/breakroleinheritance(copyRoleAssignments=false,clearSubscopes=true)

2. Find the permission level ID.

_api/web/roledefinitions/getByName('contribute')

3. Get the user id

4. You have to assign the user the above roledef id

_api/web/lists/getByTitle(<List Title>)/items(<Item ID>)/roleassignments/addroleassignment(principalid=<user id>,roledefid=<roledef id>)

[MattWeston365]

Hi @Gottijay2000 I'm delving back into my memory to when I used to do more SharePoint development, and if I remember correctly then there wasn't an explicit "remove" endpoint. The way that we did it was to reset and reapply the permissions without the user that you wanted to remove.

Is it too late to consider using SharePoint groups for your permissions instead? They are much more manageable through code.

[Gottijay2000]

@sudharsan1985 this was helpful thanks. 

[sudharsan1985]

Hi @Gottijay2000 

Please mark the correct response as a solution to help others in the community.

[Anonymous]

https://siteURL/_api/web/lists/getbytitle('listName')/items(itemID)/roleassignments/removeroleassign...)

[OliverR-82]

Anonymous' reply is a better answer to the initial question than the one that is currently marked as a solution. The question was if there was a way to remove a specific user's permissions on an item, which is what Anonymous' answer does. Whereas the suggestion that is currently marked as solution really only adds permissions for a user after breaking permission inheritance. A workaround could be to remove all permissions for all users and then reassign permissions for all users that still need them, as suggested by MattWeston365. While that is a way to achieve the desired endgoal, it's a workaround that, depending on your list and number of users, may result in a lot of unnecessary action requests from your flow.

So, to confirm Anonymous' answer, the below action removes one specific permission from one specific user, on one specific item. Do note, though, that you do need to break permission inheritance first. If you're going to need to assign unique permissions for all items in your list, it's best to break inheritance on your entire list. If you only need unique permissions on a single item, then you can break inheritance using the HTTP request described in step 1 of sudharsa1985's solution.

The following action works for me.

The URI is:

_api/web/lists/getbytitle('Meeting Notes')/items(90)/roleassignments/removeroleassignment(principalid=<userId>,roleDefId=<permissionID>) 

To get the user's principal ID, you need to make an HTTP request to the following URI:

_api/web/siteusers/getbyemail('jsmith@mysite.com') 

The URI to get the roledefID was already mentioned above, but I'll repeat it here for completeness sake:

_api/web/roledefinitions/getByName('contribute')

[Rampriyar2022]

This solution is not removing users, its only assigning different role. not sure why this is marked as accepted solution. Totally misleading!

[OliverR-82]

@Rampriyar2022  You're right, the marked solution does not really address the original question. But read the entire thread, there is a proper solution posted by Anonymous user. I also elaborated on it to further clarify. Hope it helps you.

[automateayoshii]

very good answer... thanks you and Anonymous!!