#PowerPlatformTip 137: 'SharePoint Lists Folder Permissions'

TL;DR: Enable folders in your SharePoint list’s Advanced Settings, create one folder per department, and set permissions at the folder level, every item inside inherits them automatically, with no per-item Power Automate flow needed.

💡 Challenge

Teams often need granular, department-specific permissions on list items and end up building elaborate Power Automate flows to assign rights per item, time-consuming and hard to maintain.

✅ Solution

Activate the folder feature in your list’s Advanced Settings, create one folder per department, and set unique permissions at the folder level so that all contained items inherit them automatically.

🔧 How It’s Done

1. Open the list settings

🔸 In your SharePoint list, click the gear icon → List settings.

2. Enable folders

🔸 Select Advanced settings → under Folder, enable “Make ‘New Folder’ command available” → OK.

3. Create department folders

🔸 Back in the list, use New → Folder to create one folder per department.

4. Break inheritance on a folder

🔸 Click the folder’s “…” → Details pane → Manage access → Stop inheriting permissions.

5. Assign the right access

🔸 Remove the existing groups and grant the supervisor or department group the appropriate rights.

🤖 Create Items Directly in a Folder with Power Automate

Once the folders exist, a flow that creates new list items should put them in the right folder, otherwise they land in the list root and miss the folder permissions.

1. Know what “Create item” can do

🔸 According to Microsoft Learn, the SharePoint action Create item only has Site Address, List Name, Item and Limit Columns by View. There is no folder path input, so the item is created in the list root.

2. Create the folder first (if it may not exist yet)

🔸 Use Create new folder with Site Address, List or Library and Folder Path (example from Learn: folder1/folder2/folder3). Learn describes it as “Creates a new folder or folder path”.

🔸 The action targets a list or library, so it works for the list with folders enabled from step 2 above.

3. Create the item in the folder with “Send an HTTP request to SharePoint”

🔸 Method POST, Uri _api/web/lists/GetByTitle('Test')/AddValidateUpdateItemUsingPath

🔸 Body:

{
  "listItemCreateInfo": {
    "FolderPath": {
      "DecodedUrl": "https://contoso.sharepoint.com/sites/sitename/lists/Test/Folder/SubFolder"
    },
    "UnderlyingObjectType": 0
  },
  "formValues": [
    { "FieldName": "Title", "FieldValue": "Item" }
  ],
  "bNewDocumentUpdate": false
}

🔸 FolderPath.DecodedUrl is the absolute URL of the target folder, UnderlyingObjectType is the type of item to create, formValues holds the field names and values, and bNewDocumentUpdate must be false to create a list item (all per Microsoft Learn, REST list item documentation).

🔸 The response contains a value array with the fields that were set, including Id. Check HasException for each entry.

4. Create a subfolder the same way

🔸 Use Create new folder again with the full folder path to create a subfolder.

5. Permissions

🔸 Items created in a folder inherit that folder’s permissions, as described in the steps above.

🧪 Tested: Folder Items, formValues and Moving Items

Run on a list with Choice, Multi-choice, Person, Lookup, Date, Yes/No, Number and Hyperlink columns plus a required text column.

1. Create the folder with the action, not with _api/web/folders

🔸 Create new folder with the list as List or Library and Folder Path Dept B returned a real list item: ID 20, {IsFolder} true, content type Folder. Items can be created inside it, and it shows up in ‘Get items’.

🔸 A folder created with POST _api/web/folders and {"ServerRelativeUrl": "/sites/site/Lists/Test/Dept A"} exists on disk but has no list item: GetFolderByServerRelativeUrl('...')/ListItemAllFields returned {"odata.null": true}, ‘Get items’ and ItemCount ignore it. Do not use that endpoint for list folders.

🔸 AddValidateUpdateItemUsingPath creates a folder item too: "listItemCreateInfo": { "FolderPath": { "DecodedUrl": "https://.../Lists/Test" }, "UnderlyingObjectType": 1, "LeafName": { "DecodedUrl": "Dept C" } } with formValues [ { "FieldName": "Title", "FieldValue": "Dept C" } ] returned the folder item ID 22.

2. formValues formats that worked

Column	FieldValue
Text, Number	"ZZ tip test folder item B", "42"
Choice	"In Progress"
Multi-choice	"Alpha;#Gamma"
Person	"[{\"Key\":\"i:0#.f|membership|user@domain.com\"}]"
Lookup	"1" (the ID of the target item)
Yes/No	"1"
Hyperlink	"https://www.powerplatformtip.com, PowerPlatformTip" (stored as URL and description)
Date	"31.12.2026", the site’s regional format

🔸 The date is the trap: "2026-12-31" came back with HasException: true and ErrorMessage: "Enter a date like this: 23.02.2012", and because one field failed no item was created (Id 0 in the response). With "31.12.2026" all ten fields returned HasException: false and the item got ID 21 inside Dept B.

🔸 The response is the value array with one entry per field plus an Id entry; read the new ID from FieldName Id.

3. Alternative: create in the root, then move

🔸 ‘Create item’ puts the item in the root. Moving it afterwards works with POST _api/SP.MoveCopyUtil.MoveFileByPath:

{
  "srcPath": { "DecodedUrl": "https://contoso.sharepoint.com/sites/site/Lists/Test/12_.000" },
  "destPath": { "DecodedUrl": "https://contoso.sharepoint.com/sites/site/Lists/Test/Dept B/12_.000" },
  "overwrite": false,
  "options": { "KeepBoth": false, "ResetAuthorAndCreatedOnCopy": false, "ShouldBypassSharedLocks": true }
}

🔸 A list item’s file name is <ID>_.000. After the call item 12 reported FileDirRef /sites/.../Lists/Test/Dept B with the same ID. The response is {"odata.null": true}.

🔸 Two calls instead of one, but every column keeps the ‘Create item’ JSON format from #PowerPlatformTip 133 and no regional date format is involved.

🎉 Result

You now have a folder-based structure where each department’s items automatically inherit the correct permissions, no additional flows required, saving setup and maintenance time and improving list performance. When a flow creates the items, the HTTP request to SharePoint places them in the right folder from the start.

🌟 Key Advantages

🔸 Quick setup using built-in list settings (no extra tools needed)

🔸 Automatic inheritance cuts down on manual effort and errors

🔸 Clear separation of access by department

🔸 Scales well for lists up to 100,000 items (beyond that, folder-level breaks in inheritance aren’t supported)

🛠️ FAQ

1. How do I enable folders in a SharePoint list?

Go to List settings → Advanced settings, turn on “Make ‘New Folder’ command available”, and save.

2. Do items inherit folder permissions by default?

Yes. List items automatically inherit whatever permissions are set on their parent folder.

3. Are there any limits to using folder-based permissions?

If a folder or list exceeds 100,000 items, you can’t break permission inheritance for that folder.

4. Can the “Create item” action put an item into a folder?

No. Per Microsoft Learn, the action has no folder path input. Use “Send an HTTP request to SharePoint” with AddValidateUpdateItemUsingPath and set listItemCreateInfo.FolderPath.DecodedUrl to the folder URL.

5. How do I create the folder from a flow?

Use the SharePoint action “Create new folder” with the list name and a folder path such as folder1/folder2. It returns the folder as a list item (ID, {IsFolder} true). A folder made with POST _api/web/folders has no list item and is invisible to ‘Get items’.

6. Why does AddValidateUpdateItemUsingPath return Id 0 and no item?

One of the formValues failed validation. Check every entry for HasException: true. In the test a date written as 2026-12-31 failed with “Enter a date like this: 23.02.2012”; the site’s regional format 31.12.2026 worked.

7. Can I move an existing item into a folder?

Yes. POST _api/SP.MoveCopyUtil.MoveFileByPath with srcPath .../Lists/Test/12_.000 and destPath .../Lists/Test/Dept B/12_.000 moved item 12 into the folder; the ID stayed the same.

🔗 Related Tips

• #PowerPlatformTip 110: Protect SharePoint Data, more ways to lock down list and library access.
• #PowerPlatformTip 74: Elevated Permissions, grant access from a flow when native inheritance isn’t enough.