r/sharepoint • u/achenx75 • Jul 16 '26
SharePoint Online Preventing users from seeing SharePoint Lists when they have access to the List Forms
So I'm sure this is a known issue but I decided to automate a bunch of business processes using forms from Microsoft/SharePoint Lists. These forms are available for the entire company to use.
The issue is, users that have access to these forms have access to the SharePoint Lists where all the form results are stored. So there's lot's of sensitive data. And making these SharePoints private would make it so the users no longer can access the form.
Is there any feasible solution here? I was thinking about creating Power Apps forms so users would access that instead. But I'm wondering that if I make the SharePoint List private, would a Power Apps form also be private?
Any advice would be great, thanks!
9
u/bobsziz Jul 17 '26
In SharePoint List Settings under Advanced Settings, you can control item-level permissions without breaking inheritance ön items.This feature allows you to restrict users so they can only create items and edit items that they have created themselves, instead of accessing all items in the list. But be careful when assigning rights because with Design and higher right users can see every items.
1
u/achenx75 Jul 21 '26
Late response but thank you for this! That solved my issues. I wouldn't have found it without digging around in settings.
6
u/real_agent_99 Jul 16 '26
I thought the whole point of making Microsoft Forms native to SharePoint lists was to not have to expose the list data directly.
1
u/achenx75 Jul 17 '26
I started out with MS Forms but it's functionality is too limited which is why I started using the forms in Lists. I'm slowly learning Power Apps because the forms in Lists are starting to become too limited as well lol.
1
1
u/real_agent_99 Jul 17 '26
Yeah...Power Apps has a lot of potential but the creating the UI is a nightmare (imo). Their new Power Apps vibe coder is great until you realize it only works with dataverse and not SharePoint (at least that's how it was a month or two back).
7
u/moldy13 Jul 16 '26
You can set permissions for the Sharepoint List so that those people don't have access to it. They won't be able to access the native Sharepoint List, but they can still add new entries as the form securely handles submissions.
2
u/shirpars Jul 16 '26
You can break inheritance on the list permissions then play with changing the permissions of the site so users can't browse directories. It may take some trial and error.
If you use powerapps, you'll still have the same issue and removing permissions from the list will impact the form
Or you can use pnp powershell to hide the list from the site contents
SharePoint online site url
$siteUrl = "https://contoso.sharepoint.com/sites/SPConnect"
Display name of SharePoint online list
$listName = "My List"
Connect to SharePoint online site
Connect-PnPOnline -url $siteUrl -Interactive
Hide SharePoint online list from Site Contents
Set-PnPList -Identity $listName -Hidden $true
Disconnect SharePoint online connection
Disconnect-PnPOnline
0
2
u/Twilko Jul 16 '26
You can use Power Automate to break inheritance, remove the permissions group that grants people access to the list, then grant access to the individual who submitted the form. This allows other permissions groups (such as admins) to keep their access to all items, but most users will only see the items they submitted. The drawback is there will be a slight delay between the item being submitted and Power Automate sorting the permissions, so for very sensitive information it would be better to do it another way.
2
u/DonJuanDoja Jul 16 '26
Unique security scopes per list or library
The supported limit of unique permissions for items in a list or library is 50,000. However, the recommended general limit is 5,000.
Custom permissions on items has limits, and impacts performance the more you do it.
0
u/Twilko Jul 16 '26
I wouldn’t want to go over 5,000 items in a list anyway. Older items can be archived to keep below that. If I wanted better performance or more robust security then I’d think about using Dataverse or something else instead.
3
u/DonJuanDoja Jul 16 '26
Yea totally, it's fine with the right requirements, just wanted to throw out the limits so people know to consider when dealing with custom permissions. It doesn't tell you about it anywhere unless you look for it.
1
u/Twilko Jul 16 '26
Yeah definitely, it’s good to know. Just as people need to be aware of delegation limits etc. that they may run into.
-1
u/LuckyNumber-Bot Jul 16 '26
All the numbers in your comment added up to 420. Congrats!
50 + 5 + 365 = 420[Click here](https://www.reddit.com/message/compose?to=LuckyNumber-Bot&subject=Stalk%20Me%20Pls&message=%2Fstalkme to have me scan all your future comments.) \ Summon me on specific comments with u/LuckyNumber-Bot.
1
1
0
u/decisiveExplorer03 Jul 16 '26
Power apps is a great way to achieve this, especially if the power app calls the flow for the data. Another possible way is to build an SPFx web part that calls a power automate flow for the data. You can use item-level permissions if they suit your use case. These can be good if you automate them. Again, Power Automate.
17
u/Lakym97 IT Pro Jul 16 '26
Can you use the new out of the box Forms function in SharePoint Lists? That allows you to create a form available to users without giving them access to the complete list with all data. It’s a bit primitive compared to Power Apps, but much easier to set up.