Permission Rules

Instructions

Step 1: Prepare the Vacation Requests List

For this tutorial, we'll use a Vacation Requests SharePoint list with the following columns:

• Employee Name - Single line of text
• Work Email - Single line of text
• Vacation Start Date - Date
• Vacation End Date - Date
• Reason - Single line of text
• Backup Employee - Person or Group (Allow multiple selections)
• Manager - Person or Group
• Status – Color Choice
• Manager Comments - Multiple lines of text

For the Status column, add the following choices:

• Draft
• Submitted
• Approved
• Rejected

If you already created the Vacation Requests list in the Validation Rules tutorial, add the Manager, Status, and Manager Comments columns.

Step 2: Make Vacation Dates Read-Only Based on Status

Vacation dates should remain editable while a request is in Draft. Once the request has been submitted, the dates should remain visible but become read-only.

1. Select the Vacation Start Date column and open the Permissions section
2. Click Add new rule
3. Enter the rule name: Draft Vacation Date
4. Select Write
5. Leave New, Edit, and Display selected under Apply in forms
6. Under Apply under the conditions, configure the rule to apply when Status = Draft.
7. Enable Apply dynamically
8. Save the rule.

Create another rule for requests that are no longer drafts:

1. Enter the rule name: Lock Vacation Date
2. Select Read
3. Under Apply under the conditions, configure the rule to apply when Status is not equal to Draft
4. Enable Apply dynamically
5. Save the rule.

Create the same rules for Vacation End Date.

Open the form with Status = Draft. The vacation dates can be edited.

Change the Status to Submitted. Because the rules are applied dynamically, the vacation dates become read-only as soon as the applicable permission changes.

Step 3: Control Access to Manager Comments

The Manager Comments column should be visible to employees, but only the manager assigned to the request should be able to edit it.

Permission Rules can use a Person column to determine who receives a specific level of access. In this example, the Manager column identifies the person responsible for reviewing each Vacation Request.

1. Select the Manager Comments column and open the Permissions
2. Click Add new rule
3. Enter the rule name: Manager Comments - Manager.
4. Select Write.
5. Under For users/groups, select in column.
6. Select the Manager
7. Leave New, Edit, and Display selected under Apply in forms.
8. Save the rule.

This rule allows the user selected in the Manager column to view and edit Manager Comments.

Next, create a second rule so other users can view the comments without editing them:

1. Enter the rule name: Manager Comments - Read Only.
2. Select Read.
3. Under Apply in forms, select Edit and Display.
4. Save the rule.

Open an existing Vacation Request as the user selected in the Manager column. The Manager Comments column is visible and editable.

Open the same request as another user. The comments remain visible, but the column is read-only.

This allows employees to view the manager's comments while ensuring that only the manager assigned to the request can modify them.

Step 4: Control Status Access on Different Forms

Permission Rules can be applied to specific form types and users. This allows the same column to have different permissions depending on which form is being used and who is working with the item.

In our Vacation Request form, employees do not need to see the Status column when creating a new request. Once the request has been created, the assigned manager should be able to update the Status, while other users should only be able to view it.

1. Select the Status column and open the Permissions
2. Create the first rule to hide Status when a new request is being created
3. Enter the rule name: Hide Status on New Form.
4. Select Hidden.
5. Under Apply in forms, select New
6. Save the rule.

Next, create a rule that allows the assigned manager to update the Status:

1. Enter the rule name: Manager Status Access.
2. Select Write.
3. Under For users/groups, select in column.
4. Select the Manager column.
5. Under Apply in forms, select Edit and Display.
6. Save the rule.

Finally, create a rule that allows other users to view the Status without changing it:

1. Enter the rule name: Status Read Only.
2. Select Read.
3. Under Apply in forms, select Edit and Display.
4. Save the rule.

Open the New Vacation Request form. The Status column is hidden.

Open an existing request as the user selected in the Manager column. The Status column is visible and can be updated.

Open the same request as another user. The Status remains visible, but it is read-only.

This configuration keeps Status out of the initial request form while allowing the assigned manager to manage it after the request has been created. Other users can follow the current status without being able to change it.

Results

After configuring the Permission Rules, the Vacation Request form provides different levels of access depending on the request status, form type, and user:

• Vacation dates are editable while the request is in Draft and become read-only after it is submitted.
• Manager Comments can be edited by the user selected in the Manager column, while other users can view the comments without modifying them.
• Status is hidden when a new request is created. On existing requests, the assigned manager can update the Status, while other users can only view it.

Together, these rules ensure that users can access and modify only the information appropriate to their role and the current state of the request.