Unanswered

Restrict Custom Page access

(0) Share

Report

Posted on by jraesly Microsoft Employee

Hello, I am curious if it is possible to restrict access to Custom Pages? In the Sitemap Designer, it says "You can't edit this component because it references an entity that isn't supported in Site Map Designer". I would like to use the privileges if possible. Thank you!!

There is another post for this, but is now one year old and was never updated at the end. Solved: Custom Pages in Model Driven App - Permissions? - Power Platform Community (microsoft.com)

Categories:

Power Apps Pro Dev & ISV

I have the same question (0)

All responses (6)

Answers (1)

StephanPrnb 129 on at

Like (0)

Report

I have the same Problem but I could not find any newer answers than the post you have linked...

Was this reply helpful? Yes No
Verified answer

jraesly Microsoft Employee on at

Like (1)

Report

I managed to resolve the issue effectively due to the initial system setup. We utilized a custom table, 'user roles', to assign one of our three specific roles, which was associated with the corresponding account. This structure greatly facilitated our 'Super Users' in monitoring role assignments across the organization.

Upon assigning a 'user role' to a user, they were systematically moved into the Business Unit (BU) corresponding to that account and added to the designated team that represents their assigned role. Notably, each account is linked to a unique BU, which contains three dedicated teams corresponding to our three distinct roles. Each of these teams is endowed with a security role that mirrors the function they serve within the account/BU framework.

For the scenarios where users lack the necessary 'user roles' to access certain pages, we implemented a visual cue: a lock icon accompanied by a message detailing the requisite roles they're missing.

You should be able to replicate this method by querying the users' security roles and applying similar restrictions.

While it's currently not possible to completely hide custom pages from the navigation pane, access to these pages can still be effectively controlled and restricted as needed.

Was this reply helpful? Yes No
carlose1 6 on at

Like (2)

Report

Hi,

Yes it is possible.

First you need to create a new custom Table (e.g. Custom Page Permissions).

Then create a new Security Role (e.g. Custom Page Access). For this new role, add Read only privileges to the newly created custom Table.

Then in open the model-driven app in the modern app designer. Select the Custom Page you want to apply privileges to and in the right-hand panel, expand the "Advanced Settings". You will see an option to "Add table privilege". Select the newly created table and add Read only privileges.

Finally, add users to the new Security Role. Only these users will have access to the Custom Page from the sitemap.

Was this reply helpful? Yes No
jraesly Microsoft Employee on at

Like (0)

Report

Yes that is a good, clean solution. I ended up also restricting based on certain access I knew my 3 roles had.

Was this reply helpful? Yes No
Iron Arm 18 on at

Like (0)

Report

Are you saying you developed something that allows regular users (not system admin) to assign roles? You should not do that. We actually just removed a similar implementation. Assigning roles should only be done by a system administrator. You're circumventing native security. I also think it's funny to implement something like this. Why?

Was this reply helpful? Yes No
jraesly Microsoft Employee on at

Like (0)

Report

Great points and I fully agree. To clarify, the role assignment functionality is indeed restricted to a select group of users whom we designate as 'Super Users'. These Super Users function under a controlled set of permissions tailored to their responsibilities—they do not have the full breadth of system administrator privileges. Our intent was to strike a balance between operational efficiency and security.
We took this approach to decentralize certain administrative functions that are routine and non-critical, without compromising the overall integrity of the system's native security. This allowed us to alleviate the workload on system administrators while maintaining a strict security posture. The 'Super Users' have the trust and authority within the organization to manage role assignments within their specific domain, but they cannot alter system-wide settings or access restricted data.
Moreover, the system audits all such actions, ensuring that there's a clear trail of accountability.

Was this reply helpful? Yes No