Power Platform Community Forum Thread Details

Hi all!

All of the applications we have developed so far for our business have been using SharePoint lists.

We have a business case for a salary review application.

I know that using SharePoint lists aren't the best solution for confidential data but due to licensing it will be what we will have to work with.

From the PowerApp - users will need Read/Edit permissions to read data from SP list and edit.

We then need a way to lockdown the SharePoint Site/List so that if the user somehow gains access to the SP URL they can not view data (other peoples salaries).

However, they must be able to within the app (data will be filtered in the app to ensure they only see the data they are responsible for)

Any tips on locking down SP but keeping permissions in PowerApp?

Thanks!

Categories:

Building Power Apps

Power Apps isn't designed to be a security layer. If you are using SharePoint then users must have Edit or Contribute permission to be able to write items to the list. So your only real option is to set the item level permissions of the records in the list. This can be done using HTTP REST calls, usually using Power Automate. Setting the item level permissions will restrict users from seeing or working with items that they don't have access to.

You could filter who sees what record in Power Apps, but that doesn't provide any real security because users will have access to the items if they create their own app or go directly to SharePoint. Item level permissions is the only way to do this that is truly secure.