Unanswered

Allow Sharepoint List in app, but data inaccessible outside the app

(0) Share

Report

Posted on by csSoftDev

I am in the process of building the first Powerapp for my organization and Sharepoint Lists are being used to house the data. We are looking for a way to prevent users from accessing the sharepoint on it's own as well as the lists, but still having the app work for the staff.

From what I've been reading, the user needs to have permissions to the Sharepoint list in order to use it. Is there a way for staff to have permissions to use the sharepoint list, but no access to open the list directly?

Categories:

Building Power Apps

All responses (5)

Answers (0)

Sort by

iAm_ManCat 18,256 Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

You can't 100% prevent it, but you can do a lot of steps to prevent it in many situations.

I have recently advised this in a thread here that you can follow:

Solved: Re: There MUST be a way - hide SP List from site n... - Power Platform Community (microsoft.com)
Anchov 1,986 on at

Like
a
(0)

Report
Copy link

Link copied!

Complex security is one of the big limitations of using SharePoint as data source. The only way I can think of to achieve what you want is to use Power Automate as your intermediary. Basically, you can create a PowerApps-initiated flow (or flows) that performs all the CRUD actions to the SharePoint list under the context of a service account. With a simple app, this might be a workable solution. If you have a highly complex app, this may introduce even more complexity and possibly performance issues.
iAm_ManCat 18,256 Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

The problem with this design is that flows from within Power Apps always run under the context of the user and will use the user's connections, not the service account. So you'd need to store the data somewhere so that a flow is triggered outside of Power Apps which then writes to the final list - but the user would still need access to the initial datasource the App writes too, and they could still add items there directly.
Anchov 1,986 on at

Like
a
(2)

Report
Copy link

Link copied!

In my experience with a recent client solution, I was able to change the context of the SharePoint connection used in Power Automate as a service account (instead of the logged in user) if you use the PowerAppsv2 connector. You would need to configure the Run as User configuration.

I was able to use a Power Apps initiated Power Automate to allow users to upload photos to a SharePoint Library that was restricted to only the Service Account.
iAm_ManCat 18,256 Most Valuable Professional on at

Like
a
(1)

Report
Copy link

Link copied!

Ah yes, thanks for mentioning this!

This can be pretty cool, you can override the whole connection, but that means everything done by that connector will use that connection i.e. you can't have some actions done as the user, others done as the service account, whereas in standalone flows you can have each action performed by a different account if you wanted to 🙂

There were some other issues with the v2 trigger that prevented me from using it before (I think there was a limitation on the number of inputs?) but I can't see any mention of that in the known limitations so maybe that's ok now