Deny sharepoint list access, and grant acces through powerapps

(0) Share

Report

Posted on by mandelbrot

Hi guys,

i have the following problem:

i build an powerapp for casemanagment which stores data in sharepoint online.

i have 2 permission groups

group1: "backendusers": have full access

group2: "PA users": have sharepoint contribute permission for adding and editing list item via powerapps

BUT: "PA users" should not be able to login to sharepoint online and edit existing list items!

i was able to deny acces for "PA users" to https://mycompany.sharepoint.com/sites/MYSITE

but i was nat able to deny the acces to the SP list https://mycompany.sharepoint.com/sites/MYSITE/MYLIST

is there a was to deny sharepoint webacces but grant list access through powerapps?

Thanks for your replies

Categories:

Building Power Apps

I have the same question (0)

All responses (8)

Answers (2)

Shanescows 2,218 Most Valuable Professional on at

Like (0)

Report

No. 😞 Sorry.

Was this reply helpful? Yes No
Verified answer

v-monli-msft on at

Like (1)

Report

Hi @mandelbrot,

Please understand that in PowerApps, data is stored in a data source(in your case, it's a SharePoint list), and you bring that data into your app by creating a connection. The connection uses a specific connector to talk to the data source. So data you cannot access in the original data source, you cannot use it in PowerApps either.

When you enter your credential to SharePoint within PowerApps, the connection is connected, but your credential cannot get the items in SharePoint list, so nothing would be displayed in the app.

Regards,

Mona

Was this reply helpful? Yes No
harzicn 76 on at

Like (3)

Report

I have a similar issue. I have a form that I created with PowerApps but I absolutely do not want the users to be able to find their way to the SharePoint list to see other confidential submissions.
This is my fairly simple solution.
I created a second list called Admin with exactly the same fields as the submission list. Using Microsoft Flow, I set a workflow to create a new item in the Admin list whenever an item is created. I set the fields to match the fields in the submission list. Then set the submission list item to be deleted.
This leaves the submission list empty and I set the permissions on the Admin list so that only admin users can access it.
I hope this helps.

Was this reply helpful? Yes No
Birchenall 6 on at

Like (0)

Report

Has this been resolved or is it still not possible?

Was this reply helpful? Yes No
Birchenall 6 on at

Like (1)

Report
@mandelbrot I believe I have found a work around for this.

Settings> Site Permissions> Advanced Site Permissions
Select Permission Levels from the Browse section at top.
Add a Permission Level can call it something like "Contributor" (that's what I named it).
Select the following permissions only
Add Items
View Items
Open Items
View Versions
View Pages
Use Remote Interfaces
Use Client Integration Features
Open
(I'm not 100% sure on these permissions; what I was able to deduce was that they had access to the homepage, however it does not appear in their list of personal pages, but if they entered the sharepoint URL then they could see the home page, however they can not view any other pages (e.g. documents, list, etc.) as the permissions are not available) If they do find a way of stumbling on the Home Page, I have removed all view for them to any sensitive information.
Return to the Permissions page -> Create Group - give it a name ("App User")
Set Permissions level to the one named above (Contributor)
Add New groups or user to the list (you can invite them without sending an email so they will not get a link).
Now they have access to contribute to the Sharepoint list without seeing it. At least from my testing it has worked with some small groups, but I haven't tested it when inviting the entire org yet.

Was this reply helpful? Yes No
Verified answer

AntonioMarinell on at

Like (2)

Report

Yes! Take a look at this:
https://michelcarlo.wordpress.com/2020/04/15/powershell-script-prevent-power-apps-users-from-accessing-lists-from-sharepoint-ui/

Enjoy 😉

Was this reply helpful? Yes No
mandelbrot 15 on at

Like (0)

Report

thanks @AntonioMarinell !
this was exactly what i'm looking for.
the main solution was "removing the View Application Pages permission" 💡

Was this reply helpful? Yes No
smakhan 2 on at

Like (0)

Report

Though the above mentioned way of creating the group of "Contributors" almost solves the problem.

When the group of contributors is created, they can successfully create,edit,delete list items of the sharepoint through powerapps but though they are contributors they can easily access all the lists by creating their own powerapp through their accounts and adding these lists as datasource.

How can be team members be prevented from adding this team's site lists as datasource in their powerapps?

Was this reply helpful? Yes No