How to protect CDS environment with or without security group

(0) Share

Report

Posted on by Mx81

860

Hello,

I'm confused because of these 2 cases:

1) I can create an Canvas App or a flow in a CDS environment that is secured by a Security Group and share it with users that are not members of this Security Group. No Problem

2) I cannot send an Approval out of the CDS environment that is secured by a Security Group to a user that is not member of this Security Group. Error message ("user is not member of security group").

So my question is: how shall I setup my environment.

I want to have a protected environment called "IT solutions". In this environment with CDS, only a couple of users should have the rights for creating solutions, canvas apps, flows, custom connectors. All other users should only be able to use shared apps and flows and react on approvals.

How can I handle this?

Categories:

Governance & administering

I have the same question (0)

All responses (4)

Answers (1)

v-xida-msft on at

Like (1)

Report

Hi @max81 ,

According to the issue that you mentioned, I think you have some misunderstanding on the "Security Group" in CDS Environment.

Actually, the "Security Group" is used to control data access to Common Data Service in a Environment for users in your tenant. For your first case, please note that the "Sharing" mechanism of a canvas app in PowerApps is not related to "Security Group".

The "Sharing" mechanism of a canvas app is used to share canvas app Run or Edit permission to the users in your Org, it would not share the data source resource access permission to the users.

For your second case, if you create a Approval flow in your CDS Environment using Power Automate flow, it would essentially store the Approval flow record in Approval Entities in your Common Data Service. In other words, the "Approvals" functionality in Power Automate flow is based on the "Approval" Entities in your Common Data Service:

If you assign a "Security Group" to your current Environment, only users with Common Data Service licenses that are members of this security group will be created as users and enabled in the Common Data Service environment, the other users who are not members of this Security Group would be disabled in this Environment.

So the other users are not members of this Security Group could not access the CDS data (including the "Approval" Entity) in your Environment. So you could not send an approval flow to a user outside the Security Group.

Best regards,

Was this reply helpful? Yes No
Mx81 860 on at

Like (0)

Report

thank you @v-xida-msft for that clearification. Helps indeed to understand it a little bit more.
Mayby you can also help me with the rest of my confusion.

But still my question:
I want to have a protected environment called "IT solutions". In this environment with CDS, only a couple of users should have the rights for creating solutions, canvas apps, flows, custom connectors. All other users should only be able to use shared apps and flows and react on approvals.
How can I handle this?

And also an additional question: where are Approvals stored in environments without CDS?

Was this reply helpful? Yes No
Verified answer

danman71 83 on at

Like (1)

Report

it sounds like to me you need 2 environments. One to build solutions, then export those to another environment for your other users to use. Can you clarify what you mean by Approvals?

here is the doc on Security Groups. https://docs.microsoft.com/en-us/power-platform/admin/control-user-access

We are building a more traditional environment, DEV, TEST, & PROD. Controlling access to those via Security Groups, Business unit, Teams and Security Roles. Basically DEV is where everyone works and builds,and Developers are not in the SG's that are controlling our TEST and PROD environments. Test is basically the same, individuals who test are not allowed in DEV. PROD only has a few implementer's.

Was this reply helpful? Yes No
Mx81 860 on at

Like (0)

Report

Ok, it was a kind of misunderstanding the security roles of CDS. I will therefore create a new topic.

Thanks for your feedback.

Was this reply helpful? Yes No