Unanswered

Is there any way to restrict a user (Office365) from applying for a trial? Security issue

(0) Share

Report

Posted on by Community Power Pla... Microsoft Employee

If I have an app with a SQL Server connection and I share it with an Office365 User and only give User role (not Co-Owner), will they be able to access this connector and say, create another app with this connector and access the data?

And what if they apply and get a trial account?

If I share the app with another user in my organization (as User again, not Co-Owner) they get permission to user the SQL connector even if I then remove them from the app.

Categories:

Governance & administering

I have the same question (0)

All responses (3)

Answers (0)

Sort by

Carsten_Growth Microsoft Employee on at

Like (1)

Report
Copy link

Link copied!

What you described is called implicit sharing. You can avoid implicit sharing for SQL Server considering this: https://powerapps.microsoft.com/en-us/blog/general-availability-of-the-azure-ad-sql-server-connector/

Was this reply helpful? Yes No
Community Power Pla... Microsoft Employee on at

Like (0)

Report
Copy link

Link copied!

Hi @Carsten_Growth,

Thank you for your reply. What about other data connectors? Is there a way to restrict users from the organization to create Power Apps that may take advantage of implicit sharing in other connectors?

Was this reply helpful? Yes No
TB-13091842-0 140 on at

Like (0)

Report
Copy link

Link copied!

There are some ideas presented in this thread: https://powerusers.microsoft.com/t5/Power-Apps-Ideas/Removing-user-ability-to-access-data-source-without-using-the/idi-p/92596

I found a way within SQL Server to restrict PowerApps users to publicly available data, so at least when those are implicitly shared, the users are not accessing sensitive information. But that only solves the problem to a certain extent.

Implicit sharing needs to be fixed. It's like this: one morning, you lend your neighbor a cup of sugar. You come home after work to find your entire house empty. But the police can't do a thing about it, because sharing the cup of sugar with your neighbor implicitly shared the contents of your entire house, with them.

Was this reply helpful? Yes No