We have 3 SharePoint lists to manage work orders, as follow: -
1) WorkOrder list, with ID, Status & Technician
2) WorkOrderDetails list, with ID, Description
3) WOWOD list, which manage the related between the 2 lists
now from permission perspective, we want the technician to only manage the work order assigned to them, for this we did the follow:-
1) when creating workorders using a flow we define that, only admins can edit the WorkOrder list , as we do not want technicians to manage the Status or change the technician.
2) Also for the WorkOrderDetails list , we manage the item level-permission of the item to only be editable by the admin and Assigned-To technician.
3) now everything works well till now, but when the user finishes his/her work and want to close the work order. where technicians will not have permission to do so, as they can only view the WorkOrder items without been able to modify the status to closed.
to fix this , i created a flow that get called from Power Apps using "Close" button, and do the following (where i will pass the workorder id):-
1) check if the user who calls the WF is the assigned to technician (by comparing x-ms-user-email = the work order technician email)+ the work order status = Assigned, if so, to close the work order.
2) i defined the Run Only user to be a service account:-
so i have those questions:-
1) is my above approach secure? or the technician can misuse the flow, to do things other than modifying the status from Assigned to Close? like changing the technician field?
2) can the technician benefit from the service account connection out site the flow?
3) any comment on my above approach will be highlight appreciated
Regards
