System update for SharePoint list items using App model

One of the often discussed requirements for app model is the need for updating list items without impacting the Modified By or Modified date of the item. In server side code this was done using SystemUpdate method, but we don’t have similar method as such available for app model using remote operations (CSOM or REST).

What we can do though is to manipulate Modified By and Modified date directly if needed with the right permissions. You can actually also change the Created By and Created date, if needed for example for content migration purposes, if you have the right permissions.

In short this means that you can do for example following for changing the columns of the list item.

    1: ListItem item = list.GetItemById(1);
    2: ctx.Load(item);
    3: ctx.ExecuteQuery();
    4:  
    5: User user = web.EnsureUser("i:0#.f|membership|keysersoze@usualsuspects.com");
    6: ctx.Load(user);
    7: ctx.ExecuteQuery();
    8:  
    9: item["Modified"] = DateTime.Now.AddYears(-5);
   10: item["Created"] = DateTime.Now.AddYears(-5);
   11: item["Editor"] = user.Id;
   12: item["Author"] = user.Id;
   13: item.Update();
   14: ctx.ExecuteQuery();

Wait wait wait! – Wouldn’t that actually expose possibility to change the item permission or the metadata of the item? Not precisely. This does not impact the permission of the item and we need to remember that when the used the SystemUpdate with proper permissions, this was precisely what we were able to do as well. Key point here is the needed permissions, since this capability is not available for all users or accounts with edit permissions.

Identity used for this kind of operation for overriding the item metadata will have to have at least “Manage Permissions” permission to the site before the update can be done. Person with “contributor” right can override only the modified information, but nothing else. This means that you will need to be basically administrator for applying these kind of updates for the items in the sites.

From auditing perspective this update will be also stored to the auditing logs, which cannot be modified. Auditing logs should be considered as the final version of the truth, not the item data in the SharePoint lists and you can’t override those events.

This is again one of those good snippets to keep in your tool belt when you start transforming your server side code to the new app model or when you need to apply these settings remotely in general.