Setting permissions for a Dataverse table - Approver flows

(0) Share

Report

Posted on by RandomDept

696

Hi all,

I have a simple input form that submits data to a Dataverse table.

A flow runs when new data is created in said table .

Approval gets emailed as part of the flow and updates the same Dataverse table with a result.

In the table I have the User email address and the Supervisor (Approver) address as their own columns.

Later I wanted to do a gallery showing the Supervisor I just filtered on

 Filter(Databasename,'Supervisor Email' = Super)

Only test data where the requestor and approver were the same person shows

Since the database is set to User(Read) I figured that is why.

What DB permissions do I need to allow the supervisor email to view rows created by another user?

I know setting read to Business Unit will do the job, but is there anyway to lock it down further by user?

Thank you

Categories:

Microsoft Dataverse with Power Apps

I have the same question (0)

All responses (3)

Answers (1)

narayan225 2,547 Moderator on at

Like (0)

Report
Copy link

Link copied!

@RandomDept

You have hierarchical level of control as to who sees the items created by a user in Dataverse.

You can define multiple access levels as per the documentation below:

https://learn.microsoft.com/en-us/power-platform/admin/security-roles-privileges#access-levels

Hope this helps!

Cheers

Was this reply helpful? Yes No
Verified answer

Drew Poggemann 9,287 Most Valuable Professional on at

Like (1)

Report
Copy link

Link copied!
Hi @RandomDept

First of all, you will want to utilize the "Owner" field that exists on all tables in Dataverse to be the field you are populating the User vs. a separate email field for the user. This is critical to control access using Role Based security within Dataverse. This "Owner" field identifies the User that owns the record. These users can be added from Azure AD with appropriate licensing to the Dataverse environment. You would need at least a Power Apps Per App license for each user that you are assigning the records.

After you assign Owner on the records to the appropriate users, then you can setup Roles appropriately and define for this table how you want to apply security based on the link provided by @narayan225 . You may want to allow everyone in the Business Unit to Read the records but on the Write you may only want the Owner of the record to make changes, this can all be controlled from the Role.

As for access for the Supervisors / Managers. You can utilize the out-of-the-box hierarchical security model built into Dataverse to control this access. This can be setup at Position or Manager level and has options for configuring different levels of hierarchy. Please see the following for definition and configuration https://learn.microsoft.com/en-us/power-platform/admin/hierarchy-security

This does not require the email address of the supervisor on the record, it is utilizing the standard management hierarchy you define in the organization.

Another important concept:

Access Teams - This is a great capability if you want to have specific records on a table where other specific users are collaborating on the record as well. It allows you to have assigned permissions for what are called access teams with row level access to records in tables in Dataverse. This is different than hierarchical security as you can choose any users to have access to the record (https://learn.microsoft.com/en-us/power-apps/user/access-team)

Was this reply helpful? Yes No
RandomDept 696 on at

Like (0)

Report
Copy link

Link copied!

Fantastic information, thank you.

Was this reply helpful? Yes No