Answered

Switching Powerapps SQL Connector based on the users membership of Azure AD Group

(0) Share

Report

Posted on by Community Power Pla... Microsoft Employee

Hello,

I want to build a Powerapp where the Enduser has to be inside of a specific AzureAD Group to be allowed to do certain things with data from an AzureSQL Server.

I want the App to login to the AzureSQL Server based on the AzureAD Group the user is in.

The check for the ADGroup & Permissions should happen on the SQL Server itself, not directly in the Powerapp.

So i need an option to switch the Powerapps AzureSQL Login Connection Data based on the AzureAD Group the user is in.

Is this possible, if yes, how do i manage to do that?

Greetings,

Philip

Categories:

Building Power Apps

I have the same question (0)

All responses (4)

Answers (1)

Sort by

Joel CustomerEffective 3,224 on at

Like
a
(0)

Report
Copy link

Link copied!

This isn't possible--How many databases are we talking about? You could create multiple copies of the app, each connected to a different SQL. Then share the appropriate apps with the appropriate group.

Was this reply helpful? Yes No
Rohit Sharma354 Microsoft Employee on at

Like
a
(1)

Report
Copy link

Link copied!

Hello,

Please note that when accessing the app, system checks the permissions based on user account, and if there is no connection created earlier, it ask for the consent when loading for the first time. If the app is shared with other users, then they get implicit access to the Azure SQL connector as well:

The switch account option is only if you want to access with different user account, not necessary based on which AD group a user is part of.

Was this reply helpful? Yes No
Community Power Pla... Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

Hi, quick update on my end.

Solved this by restricting the users policies on sql level.
The AzureSQL database administrator seems always be logged in as dbo from powerapps.
Other users appear as their e-mail so i could easily check if the current user is in a specific AD Group and implement Row Level Security to restrict what specific groups are allowed to see.
I found this code demo online which really helped me with this:
https://archive.codeplex.com/?p=rlssamples#RLS-Hospital-BuiltIn-Demo.sql

Was this reply helpful? Yes No
Verified answer

Community Power Pla... Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

I've got the account switching working by using this https://powerapps.microsoft.com/de-de/blog/general-availability-of-the-azure-ad-sql-server-connector/

Was this reply helpful? Yes No