Staff intranet and workflow apps

The goal

A healthcare organisation needed one place for staff to find information and submit everyday requests, without sensitive records being visible to the wrong people.

What I built

1. A branded SharePoint workspace as the staff home page.
2. Seven permission groups, designed so each role sees what it needs and nothing more.
3. Fourteen lists with item-level security, so a record can be restricted to specific people even inside a shared list. This matters for things like incident reports.
4. Approval flows in Power Automate, so requests go to the right approver automatically instead of through email chains.
5. Incident and expense apps in Power Apps, giving staff simple forms instead of paper or spreadsheets.
6. Scripted provisioning with PnP PowerShell. The whole structure (sites, lists, groups and permissions) is created by script, so it can be rebuilt or copied consistently.

Outcome

The workspace was delivered, with provisioning that can be repeated reliably.

What others can learn

• Design permissions first, pages second. Fixing permissions after content exists is slow and risky.
• Script your build. A scripted setup is self-documenting, repeatable and much easier to audit than one built by hand.
• Item-level security is powerful but needs care. Use it where data really is sensitive, and keep the group design simple elsewhere.