Content Approval as Poor Man’s Automatic Item Level Security

There’s a common business scenario with InfoPath forms.  We want allow people to fill out InfoPath forms and submit them to a library.  We want mangers (and no one else) to have access to those forms.

This question comes up now and then on the forms (e.g.

A quick way to solve this is to enable content approval on the form library.  Go the library’s version settings and set it up as shown:


Click on “Require content approval” and that will allow you to pick a value for Draft Item Security.

It’s a little counter-intuitive because we don’t think in terms of “content approval” when all we want to do is prevent people from seeing other users’ forms.  However, it works well (in my experience).  Just don’t approve those forms and they’ll always be considered “drafts”. 

Give approval rights to the people who should be able to see them and you’ve closed the loop.

This isn’t exactly big news, but the question does come up with some regularity, so I thought it would be worth posting.


Subscribe to my blog.

Follow me on Twitter at

2 thoughts on “Content Approval as Poor Man’s Automatic Item Level Security

  1. Bruce Smith

    Hi Paul,

    Thanks for the basics. Unfortunately I don’t have 2 accounts at the moment (to test as a both Approver and Member). For the “Only users who can approve items (and the author of the item)” option we’re talking about here, is the system using both the “Created By” and “Modified By” fields to determine these access rights?

    For this to work properly is it also calculating on the “Created” and “Modified” dates?

    E.g. UserA created the document on 2010-07-23-0945 (it was approved, etc. etc.) then UserB modified the document on 2010-07-24-1330.

    In this case is the mechanism intelligent enough to only let UserB see the Draft version? Or can both UserA and UserB see the Draft version?


    P.S. mstechblogs is taking forever to load…


Leave a Reply

Your email address will not be published. Required fields are marked *