Solving SharePoint Document Access Headaches: A Case Study

We hear similar frustrations time and time again: “managing access to documents in our SharePoint is a nightmare!”. People come to us all the time looking for answers because SharePoint admins are tearing their hair out trying to help team members with accessing documents they need to do their jobs effectively.

The crux of the problem is that SharePoint is essentially a folder-based document management platform. As we have written about previously, be it in SharePoint or a local network drive, folders are rigid file management structures that cause headaches, regardless of how many times you tinker with your organisation’s folder structure.

In this article, we use a case study to contrast document access permission approaches between SharePoint and M-Files. As you will see, the metadata-driven approach adopted by M-Files provides a supremely flexible framework that solves common SharePoint access problems, saving your admins time and your organisation money.

ICM Consultants uses the following categories of documents for their projects:

·        Project Planning Documents

·        Project Management Documents

·        Project Correspondence

·        Project Financial Documents

The following document access rules apply for ICM Consultants’ Project documents:

1. Executive Managers must have read and edit access to all project documents.
2. The Project Manager of each project must have read and edit access to all project documents on the projects they are in charge of.
3. Other staff members assigned to projects (‘Project Members’) must have read and edit access to all project documents for projects they are a member of, with the exception of Project Financial Documents.
4. Members of the Finance Department group must have read-only access to Project Financial Documents. They are not permitted to see any other project documents.

Now, let’s dive into how these rules would be applied by contrasting SharePoint with M-Files.

Because SharePoint’s structure revolves around document libraries and folders, ICM Consultants’ SharePoint admins need to manually configure a folder structure each time a new project commences. Let's delve into the process.

User groups for various departments are already in place. These are updated as different staff come into and out of the organisation. However, the Project Manager and Project Members differ for each project, so ICM’s SharePoint admins need to manually create a dedicated Project Manager and Project Members user group for each new project.

As you can see, there is already an amount of manual work that ICM Consultants' SharePoint admins need to perform when a new project starts off.

Now that we have user groups to manage permissions for the project, ICM Consultants’ SharePoint admins must manually create a new document library for each project. Once the document library has been set up, they now need to manually create separate folders for the four categories of project documents (planning documents, project management documents, correspondence, financial documents).

To be clear, this manual process needs to be repeated to create a folder structure for each and every new project.

Once the folder structure has been configured, SharePoint admins then need to manually apply the permissions that relate to each user group and folder to comply with ICM Consultants’ access rules. This would typically involve:

1. If access permissions from the main SharePoint site are being inherited, turning these off.
2. Granting Read and Edit permissions for the Executive Managers and Project Manager user groups to the document library.
3. Granting Read and Edit permissions for the Project Members user group (though these need to be adjusted in the next step).
4. SharePoint admins manually adjusting the Project Financial Documents folder because of the very particular rules relating to these documents. The SharePoint admins need to:
5. Exclude the Project Members user group from accessing the Project Financial Documents folder.
6. Allocate Read-only permission for the Finance Department user group to the Project Financial Documents folder.

As you can see, each time a new project at ICM Consultants commences, there is a heavy reliance on SharePoint admins to manually configure a structure within the SharePoint site to accommodate the new project.

Let’s contrast this approach with enforcing ICM Consultants’ access rules using M-Files.

When an M-Files solution is developed, an organisation’s document access rules are factored into the planning process. This enables access permissions to be fully automated once the system is implemented. Let’s have a look at how ICM Consultants’ rules would be factored into an M-Files solution. Let's see how.

Similar to SharePoint, M-Files makes use of user groups to help drive access permissions, though user groups are only one part of M-Files’ permissions framework. M-Files primarily uses metadata to drive permissions, for example by taking the names of staff members listed as Project Members on a Project object held within M-Files. In ICM Consultants’ case, there would be Executive Managers and Finance Department user groups set up as part of the M-Files solution construction.

Further, and in contrast to SharePoint, M-Files can manage what we call ‘non-document objects’. These could include contact persons, employees, suppliers, or projects. In the image below you can see an M-Files Project object containing information about a project, such as its name, code, the client, and internal personnel involved in the project. M-Files can use metadata such as the Project Manager and Project Members to grant access to documents tagged to this project.

Because M-Files does not utilise folders, a customised metadata structure is developed that caters for the types of documents the organisation works with. This removes the need for a folder structure and saves users from having to select a folder location when saving documents.

In this case, ICM Consultants’ M-Files has document classes for the different types of project documents. When documents are saved in M-Files, users can easily search for their documents via Google-style keyword searching or through filter-based shortcuts through to specific kinds of documents (e.g., Project documents sorted by projects).

Better still, M-Files allows for access permission templates to be configured and applied to document classes that require access restrictions. For example, in ICM Consultants’ case, a permissions template would be configured for the Project Financial Documents class. As illustrated in the image below, this permissions template gives read and edit access to the Executive Leadership group and the relevant Project Manager, whilst giving only read access to the Finance Department user group. Project Members do not have access, enforcing the document access rules.

This means that each time a Project Financial Document is saved to M-Files, the permissions above are automatically applied. M-Files looks at the project that a document is tagged to, recognises who the Project Manager is from the project’s metadata, then automatically grants access to that staff member using the permissions template above.

In this way, M-Files fully automates application of access permissions for ICM Consultants’ Project documents. The only thing that needs setting up manually at the beginning of a new project is a Project object in M-Files and selecting who the Project Manager and Project Members are. M-Files handles the rest.

Enforcing ICM Consultants’ project document access rules using SharePoint requires a considerable amount of manual work each time a new project commences.

In contrast, M-Files automatically applies appropriate access permissions to documents based on what they are, not where a document is saved. The M-Files approach saves organisations considerable time and cost because admins do not need to constantly manage a folder structure to enforce document access rules.

To see how easy access permissions can be with M-Files, contact the team at Innovative Content Management today for a no-obligation demonstration.