The process of building custom applications and tools that interact with Microsoft SharePoint, including SharePoint Online in Microsoft 365.
Hello Greg Booth
Thank you for raising this interesting question.
Your current setup is very close. The main challenge is that SharePoint does not natively support a true “add‑only, cannot see anything” experience when a list web part is present on a page. In practice, granting Add Items almost always implies View Items as well. Once users can see any list view, even an empty “Create Only” view, they can switch to All Items or other views and see their own records, due to the item‑level permissions you’ve configured.
Because of this, one possible improvement to your current approach would be to edit the custom page and remove the list web part entirely. Instead, you could add a simple button or link that directs users straight to the New Item form (NewForm.aspx), using a ?Source= parameter to redirect them back to your clean custom page after submission. This removes the ability to switch views, although it is still not 100% foolproof if users ever obtain the direct list URL.
A much cleaner and more robust option is to use the built‑in integrated form feature in Microsoft Lists / SharePoint lists. With this approach, users receive only a direct form link (or the form is embedded on a simple page or in a Teams tab). They can fill out and submit the form, and after submission they see only a confirmation or “Thank you” message, there is no list, no views, no items visible, and no way to navigate to the SharePoint list.
In this model, submitters do not need any permissions on the list itself, as the form securely handles submission. Items are still created with the correct Created By value, so your existing item‑level permissions (for example, “Read items that were created by the user”) continue to work exactly as expected for administrators or managers who do have list access. You can even remove list permissions from the CallHandlers group entirely if you wish, the form will still function correctly.
This approach completely eliminates the view‑switching issue you encountered with the list web part. It works well for internal users within your Microsoft 365 tenant, keeps the form separate from the list itself, and ensures users cannot see the list unless you explicitly grant them access. You may keep your AddOnly permission level if you still want certain users to have limited direct list access, but it is no longer required for form submitters.
Overall, this approach is simpler, more secure, and provides exactly the “add new items without seeing them afterward” behavior you are aiming for.
I hope this information is helpful.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.