SharePoint 2013 removed the permissions actions from Workflows for whatever reason, so to accomplish this, you must create a SharePoint 2010 Workflow within your site.
For one of my projects, I needed to build a workflow in SharePoint Designer (chosen primarily due to the time constraints and the financial impact to the client) that stripped permissions from a Task and rebuilt those permissions so that only the Creator (or the person delegating the task), the Assignee, and their respective managers could see the specific task.
The Challenges
Due to the nature of this particular workflow, there are a couple constraints and limitations within SharePoint Designer.
- Limitations within SharePoint 2013 Workflows:
- No permission actions within SharePoint Designer, see installation) if you have access to upload and activate solutions & for Visual Studio if you have Visual Studio)
- No impersonation steps
- IMPACT: Forced to use Visual Studio to accomplish these goals
- Limitations within SharePoint 2010 Workflows:
- No looping ability out-of-the-box
- Lookup Manager of User applies only to one specific user
- IMPACT: Assigned To field can only take one user
Due to time constraints, we opted to go with using a SharePoint 2010 Workflow accepting the known limitation of the Assigned To field.
Planning the Workflow
Assuming that you already know how to create a workflow, let’s get started on building a SharePoint 2010 Workflow. I like to use multiple steps and workflow statuses for organization and debugging purposes only (please note, Log to History List action is your friend). First, let’s take a high level overview of what we would like to do on creation or modification:
- Strip All Permissions
- Parallel Actions:
- Add Creator’s and Creator’s Manager’s or Managers’ Permissions
- Add Assignee’s and Assignee’s Manager’s or Managers’ Permissions
The Visio Diagram is large but provides a good visualization of what will be happening.
Building the Workflow
In the Step 1, I rename it to something like Start Workflow, and I always Set the workflow status to Started. Next I create a variable for current user.
Next you want to add an Impersonation Step to be able to remove all the permissions and re-add permissions. First, add a Step and rename it to Strip Permissions, and add a Set workflow status action naming the status to Strip Permissions. Then, add the action to Remove permissions from item. To configure this action, click on these permissions. The Remove List Item Permissions modal will appear. Click Add…, and another modal will appear. Here is where you select the permissions and the user(s). Click Choose to select the users or user groups. Here I add all the groups and the Everyone user, if present. To add a group, click on the group (e.g., Approvers). Now, you are able to select the permissions you wish to remove, and here I select all the permissions. Then click on this list and click OK to select Current Item.
Now that the permissions have been stripped, we need to re-add the permissions. While these next steps can be done sequentially, for optimization purposes, I run them in parallel because they are basically the same process on two different set of workflow variables. In programming, this would be a simple function to parse the users, loop through the users and on each user loop through their hierarchy. However, in SharePoint Designer, we have to get creative.
