Is there a way to "lock" a document in a project so that only the user can see it? We have a need for privacy on some sensitive documents, that even other system admins cannot have access to.

I'm looking for answers on this same topic.

Hi Kelly and Jonathan,

Although I believe this is an enhancement being considered, to my knowledge there is no way to hide a document (or anything else within Workfront) from a user that has SysAdmin access.

Regards,

Doug

Hi Kelly,

By default, users will automatically inherit access to documents if they have permissions to the task or project where the document resides (unless this has been disabled in your access levels). However, you can remove access to an individual document by clicking on it, going to the sharing settings and removing the 'inherited access' tab + the names of any users that appear outside of this tab that you also don't want to see the document.

This will not work for sys admins though. They have all the power(!) in Workfront and can view anything, regardless of whether it is shared with them or not.

The only other suggestion I can give would be to password protect the file before it is uploaded to Workfront. Users will still be able to download the file, but they wont be able to open it without the password. Although please note that Workfront proof wont work with a password protected file.

Hope this helps!

Best Regards,

Rich.

How would you have a SysAdmin that didn't have control/access to every nuance of the system? Would make it really tough to administer, troubleshoot, and make good decisions with total access.

Is there a way to train and vet the SysAdmin so you could trust them?

Skye was in the right area of thought on this. Presuming Workfront is not the only document storage platform available to you, and you have a platform that is supported by one of the "out of the box connectors" (OneDrive, Google Drive, Box, Dropbox); user A can store the document, or folder of documents, on the other service, then link to them in the Workfront project. It will appear as though the document is now in Workfront, but really it's just an alias to the actual document in the other platform. So if user B tries to open or download the document, they'll be prompted to authenticate in the other platform - where they must also have been granted access to the document. If they haven't, they won't be able to view/download the document. They will simply know the document exists, its name, etc. If those details are too sensitive for even an admin to see, Workfront is not the place to store such a sensitive document.

@kellybu1 just checking in! Were you able to get this resolved? If one of the replies above helped—whether it completely solved the issue or simply pointed you in the right direction—marking it as accepted can make it much easier for others with the same question to find a solution. And if you found a different way to fix it, sharing your approach would be a great contribution to the community. Your follow-up not only helps close the loop but also ensures others benefit from your experience. Thanks so much for being part of the conversation!