Power Platform Community Forum Thread Details

I'm used to Canvas apps connecting to SharePoint, where all apps/sites have access to AD, and where permissions can be site on one site that are completely different than another site, as each site can have different SharePoint groups with different permissions.

For Power Apps, I can have different security roles to support different apps, but users are still going to be grouped into business units which are specific to the environment. In App 1, all HR staff need permission to view all data for all child business units. In App 2, HR staff should only see their own rows, and its IT staff that should see all rows for all business units. Does this mean these apps should be in different environments as to get access to unique parent/child business units for each environment?

Also, I need to do approvals with managers, which is not synced from AD automatically. So, I need to set up a flow to sync managers to the users in dataverse? If I'm going to have 10 environments, I need to configure this flow for all 10?

Categories:

Microsoft Dataverse with Power Apps

Hi @Mike2500

Actually, what you are asking for is something common that is requested in many organizations, if we see your requirement.

The first thing I suggest is that you study about security roles, where you can give access to data as a user, business unit or organization, that is, granular.

Then you must agree with the business units so that users who are present in a business unit can see what corresponds to them. Today there is a functionality that allows a user to be in several business units. You also have teams where you group users and you can also add security roles to these.

https://learn.microsoft.com/es-es/power-apps/developer/data-platform/security-roles

https://learn.microsoft.com/es-es/power-platform/admin/create-edit-business-units

Regarding the flows, you do not have to have n environments, simply if you are connected to the Microsoft ID. Enter your environment and you will be able to search for the users to whom you send the approval within the Power Automate flow. If you do not have it synchronized, perhaps you should, within the Dataverse users table, place the user who is an administrator in a field called administrator