Document Approvals in SharePoint Online, including PDF Conversion, Watermarking and Securing Files

In one of my previous blog posts, we modified an existing Power Automate Approval template and customized it to meet our requirements.

Power Automate allows you to manage the approval of documents across several services, including SharePoint, Dynamics 365, OneDrive for Business etc. This makes Power Automate an increasingly popular choice for running business processes.

In this post, we’ll keep the theme going and follow best practices to create a robust Document Approval Solution for SharePoint Online.

Before we start building our Approval Solution, let’s review the approval scenario we’ll be following:

• A User will submit documents that contain sensitive information to a SharePoint Online library and the user will then start the approval process manually.
• Once the approval process is started, the designated manager will receive an email with the file included as an attachment.
• If the manager ‘Approves’ the request:
  • The document will be converted to PDF.
  • A watermark will then be added diagonally across, reading ‘Confidential’.
  • The file will then be secured with an ‘Owner password‘ and ‘Restrict Printing and Content Copying‘.
  • The original document will then be deleted from the source library.
  • Once The PDF is created, it will be uploaded to the public Library.
• If the manager ‘Rejects‘ the request, an email will be sent to the user with the manager’s comments.

Please make sure the following prerequisites are in place:

1. Muhimbi PDF Converter Services Online full, free or trial subscription(Sign up).
2. Appropriate privileges to create Flows.
3. Office 365 Outlook and Office 365 Users account.
4. Working knowledge of Microsoft Power Automate and SharePoint Online.

Setting up SharePoint Online to run our process.

• Create a new Document library and Create an Multiline column(Approval comments) and add it to the default view.

From a High level our Flow will look like:

Step 1:

For this demo, we will use the ‘For a selected item‘ SharePoint Trigger action. We use this trigger to start the Flow manually from the SharePoint Online user interface.

Step 2:

Add the ‘Get file properties’ SharePoint action and select the ‘Library Name‘ in which you want to Run the document approval process and pass the ‘ID‘ value to the ‘Id‘ field.

Step 3:

Add the ‘Get file content‘ SharePoint action and pass the ‘Identifier‘  (Output of ‘Get file properties‘ action) into the ‘File Identifier‘

Step 4:

Add the ‘Get manager (V2)‘ action and pass the ‘User Id‘ (Output of the ‘For a Selected File‘ trigger action into the ‘User (UPN)‘.

Step 5:

Add the ‘Start and wait for approval’ action and configure it with reference to details below :

• ‘Approval type‘ – Approve/Reject – First to respond.
• ‘Title‘ – Approval Request by ‘User Name‘ the output of the ‘For a Selected File‘ Trigger.
• ‘Assigned To‘ – ‘Mail‘ the output of the ‘Get Manager (V2)‘ action.
• ‘Attachment Name – 1‘ – ‘fileName‘ the output of the ‘For a Selected File‘ trigger.
• ‘Attachment Content‘ – ‘File Content‘ the output of the ‘Get file content‘ action.

Note: You can configure the details and other values as per your requirements.

Step 6:

Add a ‘Condition‘ and set ‘Outcome‘ (Output of the ‘Start an approval action‘ is equal to ‘Approve‘).

Now if the Condition validates to ‘Yes‘ , we will ‘Convert the document to PDF‘, ‘Secure the PDF‘ with an ‘Owner password‘ and ‘Restrict printing‘ and ‘Content Copying‘, ‘upload the PDF‘ file to SharePoint public folder, ‘Delete the original file‘ and ‘Send an Email‘ to the user that the document is approved and uploaded to the public folder. Now, lets review each step in detail.

Step 7a :

In the ‘If Yes‘ section for the condition add the Muhimbi ‘Convert document’ action.

• ‘Source file name’:  ‘fileName‘ the output of the ‘For a selected file‘ trigger.
• ‘Source file content’: ‘File Content‘ the output of the ‘Get File Content’ action.
• Output format: Select the ‘PDF‘ from the dropdown.

Step 7b:

Add the Muhimbi ‘Add text watermark‘ action and configure it with reference to details below. The configuration will create a diagonal Watermark on the PDF with text ‘Confidential‘.

• ‘Source file content‘: Use the ‘Processed File Content’ the output of the Muhimbi ‘Convert to PDF’ action.
• ‘Watermark Content‘: Add text Confidential (Watermark Text).
• ‘Font family‘: Arial (Name of font e.g. Arial, Time Roman, Calibri etc.)
• ‘Font color‘: #000000 ( Color in RRGGBB notation).
• ‘Text alignment‘: Middle Center.
• ‘Word Wrap‘: Word.
• ‘Position‘: Middle Center.
• ‘Width‘: 200.
• ‘Height‘: 200.
• ‘Source file name‘: Use the ‘Base File Name’.pdf the output of the Muhimbi ‘Convert to PDF‘ action.
• ‘Rotation‘: 45.
• ‘Opacity‘: 50.

Step 7c:

Add the Muhimbi ‘Secure PDF’ action.

• ‘Source Filename’ – Add the ‘File Content’ the output of the ‘Get file content’ SharePoint action.
• ‘Open Password’: An optional password that the user must enter in order to open the document. Please note that any password entered here is displayed in clear text to allow Power Automate action field references to be added.
• ‘Owner Password‘: An optional password that the user must enter in order to change the PDF restrictions. When specifying any PDF Restrictions, this password must be set. Please note that any password entered here is displayed in clear text to allow Power Automate action references to be added.
• One or more restrictions to apply to the PDF file, separated by a pipe ‘|’ character . By default it applies all restrictions(Print|HighResolutionPrint|ContentCopy|Annotations|FormFields|ContentAccessibility|DocumentAssembly), but any combination is allowed. Enter the word Nothing to not apply any restrictions. In order to activate these settings you must supply an owner password.

Configure the action with reference to screenshot below:

Step 7d:

Use the ‘Create file’ SharePoint action to write the generated PDF document to the output document library.

• ‘File name‘: Use the ‘Base File Name’.pdf the output of the Muhimbi ‘Secure document‘ action.
• ‘File Content‘: ‘Processed file content‘ is the output variable of the ‘Secure document’ action.

Step 7e:

Use the ‘Delete file’ SharePoint action and delete the file from the ‘Approval‘ source library.

• ‘File Identifier‘: ‘Identifier‘ the output of the ‘Get file content‘ action.

Step 7f:

Add the ‘Send an email (V2)’ action to send an update that to the person who requested the ‘Approval‘.

• ‘To‘: ‘User email‘  the output of the ‘For a selected file‘ trigger.
• ‘Subject‘: You can create a dynamic ‘Subject‘.
• ‘Body‘: You can create your own email body using a dynamic variable.

If the Approver ‘Rejects‘ the document, we will send an email that the document has been rejected and update the column with the ‘Response comments‘.

Step 8a:

In the ‘If No‘ section for the condition add the SharePoint ‘Update file properties’ action and update the column in the source ‘Approval‘ library.

Note: ‘Apply to each’ will be added automatically around the ‘Update file properties‘ action as soon as you add the ‘Reponses Comment’ variable as it is of type ‘array’.

• ‘Id‘: ‘ID‘ the output of the ‘For a selected file‘ trigger.
• ‘Title‘: ‘Title‘ the output of the ‘Get file content‘ action.
• ‘Approval comment’: ‘Response Comments‘  the output of the ‘Start and wait for approval‘ action.

Step 8b:

Outside the ‘Apply to each‘ loop, add the ‘Send an email (V2)’ action to send an update to the person who requested the ‘Approval‘.

• ‘To‘: ‘User email‘  the output of the ‘For a selected file‘ trigger.
• ‘Subject‘: You can create a dynamic ‘Subject‘.
• ‘Body‘: You can create your own email body using a dynamic variable.

Step 9:

Configure RUN-ONLY User. 

In this blog post we used the ‘For a selected item’ trigger to manually start a Flow on a document. This works similarly to Flows that are automatically triggered when a file is created or changed, with one major exception, which is that by default the person starting this Flow will need to authenticate to all services used by it. Although sometimes this is desirable, in general it is not particularly user friendly, especially for non-technical users.

To keep things easy for the end-users, we use Flow’s ‘run-only users’ facility to preconfigure the account used to authenticate with Muhimbi’s conversion service. Configure this setting using the ‘manage run-only users’ card, just below the ‘Owners’ card, see the screenshot below.

All Done! Navigate back to the original library and select an item. Click on the Flow dropdown and click on the name of the Flow you created. Click on Run Flow, it should trigger your Approval process.

If the Customer Approves the document

Properties of a Secured PDF File

If the customer rejects the Approval, the column will be updated in the source Approval library.

Subscribe to this blog for the latest updates about SharePoint Online, Power Automate (Microsoft Flow), Power Apps and document conversion and manipulation using The PDF Converter.