Unanswered

Controlling Record Access by App

(0) Share

Report

Posted on by CH-24102312-0

Hi, a hypothetical question!

There are 2 similar apps using the same team-owned DV tables. Each app has it's own Security Group

A user should only be able to access records created by the app they are using. Is that possible, even if that user is a member of both Security Groups?

Thanks in advance

Categories:

Governance & administering

I have the same question (0)

All responses (4)

Answers (0)

ChrisPiasecki 6,422 Most Valuable Professional on at

Like (0)

Report

Hi @ChrisHarper,

I think you mean each app has a Security Role assigned to it, not Security Group.

Dataverse security is based on record ownership. The most common approach is, to use Business Units or Owner Teams to limit access between different sets of users. Then ensure the Security Role privileges are appropriately scoped at the business unit or team/user level based on which approach you decide.

Note that a user can only belong to a single business unit, but can be part of multiple owner teams.

---
Please click Accept as Solution if my post answered your question. This will help others find solutions to similar questions. If you like my post and/or find it helpful, please consider giving it a Thumbs Up.

Was this reply helpful? Yes No
CH-24102312-0 on at

Like (0)

Report

Hi @ChrisPiasecki, thanks for your reply

As the apps are performing very simlar activities on the same kind of data, both their Security Roles would be the same, or at least have the same priviledges. Each app would have it's own Security Group controlling who can access each app. I believe that a Security Group is a particular type of Team

There would be a small number of people who can access both apps and therefore be in both Security Groups. Where this is the case, I'd like the user to only see the records created by the app they are currently using. If the records are Team or Business Unit owned, that would seem to work for those in a single team but I'm not sure if they were in both Teams / Security Groups? As you point out, a User can only be in one Business Unit, so that wouldn't be a solution

I'm curious to know if there is a workable solution

Was this reply helpful? Yes No
CH-24102312-0 on at

Like (0)

Report

I realise this could be addressed by adding a column and recording which app is creating the record, and then filtering the records before displaying in the Canvas App. I'm just curious to know if there is a better solution using Dataverse built in security

Was this reply helpful? Yes No
CH-24102312-0 on at

Like (0)

Report

Having looked into this further, I don't think it's possible just using the Dataverse security features. Aligning apps with either Business Units, Teams or Security Roles, a user could either be restricted to a single app (which wouldn't work as users need to access multiple apps) or, due to cummulative priviledges, they would see all records irrespective of whichever app has created the record

Was this reply helpful? Yes No