Product / Knowledge Base / 8. Security and Roles

8. Security and Roles

User & Administration Guide — Version 1.0.0.21

Guide summary

Site owners, app administrators, and seven built-in roles control who can design, decide, and read.

On this page

Requester, approver, and administrator in one approval workflow
Requester, approver, and administrator are the three roles most people meet first. The site also has a workflow designer, a department admin, an auditor, and a watcher.

Site owners

A SharePoint site owner can open the app and Settings even when no role has been assigned. App administrators are an extra list of up to 40 people or SharePoint groups who can also open Settings.

Built-in roles

  • System administrator — full access, including settings, security, and setup.
  • Department admin — requests, budgets, and design for a department.
  • Workflow designer — forms, workflows, and lookups.
  • Approver — decides assigned requests and manages their own delegations.
  • Requester — creates, submits, and withdraws their own requests.
  • Auditor — reads reports, the audit log, and exported requests.
  • Watcher — views the dashboard and requests they follow.

Assign a role directly to a person, or map a SharePoint group. A direct assignment is the role you see on that person. Changing a role label does not rename the internal role.

Content rights

App roles decide which pages open. SharePoint permissions still decide which files and list items the person can read. Hiding a page in the app does not grant access to a list the person cannot open in SharePoint.