Information Rights Management: Protecting Forms
In a recent post, we discussed ways to protect sensitive data in your InfoPath forms. This article will drill down on one of these mechanisms - Information Rights Management, a.k.a. IRM. InfoPath 2007 features the ability to set permissions on both the form template that you’re designing and the forms that are based on it. You can choose to restrict who can read or write your form/form template, as well as whether read permissions include the ability to copy, print, etc. This feature is available in the both the designer and editor by clicking the Permission button on the Standard toolbar:
Form instance permissions
When filling out a form, users can set permissions for that particular form. Clicking on the Permissions button in the Standard toolbar will pop up the following dialog:
The user that created that instance of the form will have full control permissions and can grant read or write permissions to other users. Users that do not have any permissions to that form will not be able to even open it.
This feature can make InfoPath a great tool for scenarios where some degree of privacy is required, for example, feedback to a manager to peer.
Form template permissions
In addition to setting permissions for each individual form that is filled out, InfoPath also provides Permission functionality for the form template. When designing a form template, clicking on the Permissions button will pop up the Permission dialog:
The ‘Restrict permission to this form template’ checkbox at the top will initially be unchecked – check it to turn on Permissions. You will then be able to select users or groups that will have different levels of permissions for this form template.
Keep in mind that this area only allows you to control access to the form template itself, not to the forms that are based upon it. To restrict permissions to the forms based on this form template, you would check the second checkbox, ‘Restrict permission to forms based on this form template’:
As mentioned for users setting these permissions in the editor, the user that created the instance of the form will always have Full Control permissions for that form instance, but you can get more specific by clicking ‘Change permissions…’. Here you’ll be able to select who will have Read and Change permissions and which additional features will be available to users.
If you are designing a form for your specific team, you can take advantage of this feature to only give Write rights to members of the team. Everyone else can be given Read rights.
Managing your credentials
When working with InfoPath forms or form templates that have restricted permissions, you can select an account to access the content with. For example, if your personal e-mail address does not have permissions to view an expense reporting form, you can set InfoPath to use your work address instead.
You can access this feature by clicking on Manage Credentials in the File menu:
Thanks all. I hope you find this useful.
One thing to keep in mind is that IRM is not a security feature – there are ways to get around it. It’s there to make it more difficult for users to accidentally or maliciously tamper with sensitive data.
Bojana
Program Manager
Comments
Anonymous
December 25, 2006
InfoPath 2007 resources General resources InfoPath General Overview InfoPath team Blog Designing FormAnonymous
March 18, 2007
How would you do this programmatically as a process in WF or sent by MOSS without user intervention? Thanks Mike WalkerAnonymous
May 22, 2007
Hi, I have to admit that this post is long overdue. In the last two weeks, I came across a lot of peopleAnonymous
May 22, 2007
Hi, I have to admit that this post is long overdue. In the last two weeks, I came across a lot of people