cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
Anonymous
Not applicable

Users Don't Have Access to Data Even Though Sharepoint Lists Have Been Shared With Them

I have several PowerApps connected to SharePoint lists as their data sources. For each app, there I created a user group on the SharePoint site called "[App Name] Users". For each list that is connected to a given app, I have gone into list permissions, chosen "Stop inheriting permissions", and added the App user group to the permissions on the list with "Full Control." I do this because it limits the access that users have to data they don't need to see, and has worked for about 5 months so far.

 

Yesterday, I ran into some issues. The first was with one user. This user was part of the App User Group and had each list shared with her individually. I deleted her from the "individual share", but she was still added to the user group that had full control to each list (that had been working for everyone else). If she opened the SP list directly, she had full control. But, if she tried to go through the app, she got an error saying she didn't have permissions to the list.

 

After an hour of troubleshooting, I decided to reset all the permissions on the SP site and redo them, as I wanted to reorganize from the ground up. After doing this, all of my users lost access to their data. Even after re-sharing the lists with the same user groups as before, exactly how it was set up before, none of them are able to use the app.

 

I have tried everything I can think of. I refreshed the data sources in the apps and re-published them. In addition, I can no longer create a user group and share data through the app. Even creating a new user group, new sharepoint list, and new app (again, exactly as it was set up before when it worked), my users cannot use the app.

 

The only method I have found that works is to add users to the "Site Owners" user group, which, for obvious reasons, isn't an acceptable solution.

 

Am I missing something obvious, or is this a bug?

1 ACCEPTED SOLUTION

Accepted Solutions
Pstork1
Most Valuable Professional
Most Valuable Professional

Ok, let me try and take another stab at what I think is happening.  I just tested this and it works for me. I think the issue you are having is a misunderstanding of how SharePoint groups work in SharePoint, and not an actual problem with permissions.

 

  • Permissions are granted to securable objects in SharePoint (sites, webs, lists, items) based on the intersection of three things.  The securable object, the user or SharePoint Group, and the permission level assigned.
  • Permissions assigned at the root site of he site collection inherit down until they reach a spot where permission inheritance is broken.  When broken existing permissions are copied into the new settings creating he top of a new inheritance chain.
  • Here's the key that I think is causing the problem.  Although groups can be created at any point in the hierarchy they are always scoped for the whole Site collection.  So if you break inheritance at the list level and remove a user from a group, you are removing that user from that group (and any permissions) anywhere in the hierarchy. So when you break inheritance in a list, and then go back to the top of the site and remove them from the group or delete the group then you delete their permissions related to that group everywhere.

 

Here's what I tested that works for me.

  • I created a PowerApp based on a SharePoint list and shared it with a user.
  • I went to the list and broke security inheritance. I then gave the user permissions to that list directly.  I could have also created a new group, put the user in the group, and given that group permission.
  • I then went back to the top of the site and removed the user from the original group.

The user now has only limited permissions in the root site and contribute permissions to the list. The PowerApp works fine.

 

I think you have inadvertantly been removing the user's permission to the list when you change or delete the list at the site level.

 



-------------------------------------------------------------------------
If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

View solution in original post

8 REPLIES 8
Pstork1
Most Valuable Professional
Most Valuable Professional

    There are a couple things that are combining to cause your issue.  The primary one being that the application is using OAUTH to access the SP lists and not using the user's authentication directly.  Users create an Oauth connection the first time they run an app. The app will continue to use that connection and the permissions associated with it until the connection times out or is removed and replaced. So one of your problems is that changing permissions on existing users won't change the OAuth connection used by the app.

 

I suspect another issue is that user group membership is cached and changes to existing groups may not be reflected by SharePoint for several hours.  So a lot of the changes you made to group membership may have worked if you waited overnight.

 

To fix it now I suspect you'll need to create new groups and assign them the permissions to the list, add the users to the groups, and create new connections in the apps so users are prompted for a new OAuth connection when they log into the apps again.



-------------------------------------------------------------------------
If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.
Anonymous
Not applicable

Thanks for your response, I didn't know about the OAUTH connection.

 

I have tried to create an entirely new app, new list, and new user group, though, with no success. Is there some kind of setting you need to enable in SP to enable PowerApps connections?

Pstork1
Most Valuable Professional
Most Valuable Professional

No special setting.  But you may be using an existing connection even in the new app. If you go to connections in the PowerApps web site you can see a list of connections and which apps are using each connection.



-------------------------------------------------------------------------
If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.
Anonymous
Not applicable

I just tried manually deleting the data connections in the app and re-adding them - it worked! Thank you so much for your help!

Anonymous
Not applicable

Sorry, this didn't actually work.

 

It appears that deleting and re-adding the connections has nothing to do with solving this issue.

 

Currently, if I add the user groups to have Full Access to the SharePoint site the lists are located in and have each list set to Inherit Permissions, my users gain access to the data in the app. This happens in real-time, less than a second after the change is made.

 

However, if I go into SharePoint after that and set the lists to Stop Inheriting Permissions, then remove access to the full site through the site's permissions settings, they instantly lose access. Even though the list permissions show that they still have Full Control access, they lose the permissions through PowerApps. Adding them back to the site's permissions instantly gives them access to the data again through PowerApps. I have tried deleting the connections in the apps and re-adding them between each step in this process to no avail.

Pstork1
Most Valuable Professional
Most Valuable Professional

Ok, let me try and take another stab at what I think is happening.  I just tested this and it works for me. I think the issue you are having is a misunderstanding of how SharePoint groups work in SharePoint, and not an actual problem with permissions.

 

  • Permissions are granted to securable objects in SharePoint (sites, webs, lists, items) based on the intersection of three things.  The securable object, the user or SharePoint Group, and the permission level assigned.
  • Permissions assigned at the root site of he site collection inherit down until they reach a spot where permission inheritance is broken.  When broken existing permissions are copied into the new settings creating he top of a new inheritance chain.
  • Here's the key that I think is causing the problem.  Although groups can be created at any point in the hierarchy they are always scoped for the whole Site collection.  So if you break inheritance at the list level and remove a user from a group, you are removing that user from that group (and any permissions) anywhere in the hierarchy. So when you break inheritance in a list, and then go back to the top of the site and remove them from the group or delete the group then you delete their permissions related to that group everywhere.

 

Here's what I tested that works for me.

  • I created a PowerApp based on a SharePoint list and shared it with a user.
  • I went to the list and broke security inheritance. I then gave the user permissions to that list directly.  I could have also created a new group, put the user in the group, and given that group permission.
  • I then went back to the top of the site and removed the user from the original group.

The user now has only limited permissions in the root site and contribute permissions to the list. The PowerApp works fine.

 

I think you have inadvertantly been removing the user's permission to the list when you change or delete the list at the site level.

 



-------------------------------------------------------------------------
If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.
Anonymous
Not applicable

This was close to the solution I found, and the way that it worked before I reset the permissions on my SP site. I found that I have to give my users at least "Restricted Interfaces for Translation" permissions to the main site in order for them to use the apps. I could follow those steps directly and it would work right up until the last step where you remove their access to the site-level, and then a user would instantly lose access to the data in the app.

 

I did notice that something is up with the "Limited Access" permission level after the reset. It doesn't seem to be generating properly when I grant access to a specific list like it did before. It's hard for me to tell, because I have very limited access to my SP site and I have to go through IT for some changes.

 

Regardless, you've taken a significant portion of your day to help me - thank you very much!

Pstork1
Most Valuable Professional
Most Valuable Professional

Users will need limited access at the site level, but that should be granted automatically when you break inheritance. It could be that something you are doing in your PowerApp requires the other permission, but limited access should normally be enough.



-------------------------------------------------------------------------
If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

Helpful resources

Announcements

Calling all User Group Leaders and Super Users! Mark Your Calendars for the next Community Ambassador Call on May 9th!

This month's Community Ambassador call is on May 9th at 9a & 3p PDT. Please keep an eye out in your private messages and Teams channels for your invitation. There are lots of exciting updates coming to the Community, and we have some exclusive opportunities to share with you! As always, we'll also review regular updates for User Groups, Super Users, and share general information about what's going on in the Community.     Be sure to register & we hope to see all of you there!

April 2024 Community Newsletter

We're pleased to share the April Community Newsletter, where we highlight the latest news, product releases, upcoming events, and the amazing work of our outstanding Community members.   If you're new to the Community, please make sure to follow the latest News & Announcements and check out the Community on LinkedIn as well! It's the best way to stay up-to-date with all the news from across Microsoft Power Platform and beyond.    COMMUNITY HIGHLIGHTS   Check out the most active community members of the last month! These hardworking members are posting regularly, answering questions, kudos, and providing top solutions in their communities. We are so thankful for each of you--keep up the great work! If you hope to see your name here next month, follow these awesome community members to see what they do!   Power AppsPower AutomateCopilot StudioPower PagesWarrenBelzDeenujialexander2523ragavanrajanLaurensMManishSolankiMattJimisonLucas001AmikcapuanodanilostephenrobertOliverRodriguestimlAndrewJManikandanSFubarmmbr1606VishnuReddy1997theMacResolutionsVishalJhaveriVictorIvanidzejsrandhawahagrua33ikExpiscornovusFGuerrero1PowerAddictgulshankhuranaANBExpiscornovusprathyooSpongYeNived_Nambiardeeksha15795apangelesGochixgrantjenkinsvasu24Mfon   LATEST NEWS Business Applications Launch Event - On Demand In case you missed the Business Applications Launch Event, you can now catch up on all the announcements and watch the entire event on-demand inside Charles Lamanna's latest cloud blog.   This is your one stop shop for all the latest Copilot features across Power Platform and #Dynamics365, including first-hand looks at how companies such as Lenovo, Sonepar, Ford Motor Company, Omnicom and more are using these new capabilities in transformative ways. Click the image below to watch today!     Power Platform Community Conference 2024 is here! It's time to look forward to the next installment of the Power Platform Community Conference, which takes place this year on 18-20th September 2024 at the MGM Grand in Las Vegas!   Come and be inspired by Microsoft senior thought leaders and the engineers behind the #PowerPlatform, with Charles Lamanna, Sangya Singh, Ryan Cunningham, Kim Manis, Nirav Shah, Omar Aftab and Leon Welicki already confirmed to speak. You'll also be able to learn from industry experts and Microsoft MVPs who are dedicated to bridging the gap between humanity and technology. These include the likes of Lisa Crosbie, Victor Dantas, Kristine Kolodziejski, David Yack, Daniel Christian, Miguel Félix, and Mats Necker, with many more to be announced over the coming weeks.   Click here to watch our brand-new sizzle reel for #PPCC24 or click the image below to find out more about registration. See you in Vegas!     Power Up Program Announces New Video-Based Learning Hear from Principal Program Manager, Dimpi Gandhi, to discover the latest enhancements to the Microsoft #PowerUpProgram. These include a new accelerated video-based curriculum crafted with the expertise of Microsoft MVPs, Rory Neary and Charlie Phipps-Bennett. If you’d like to hear what’s coming next, click the image below to find out more!     UPCOMING EVENTS Microsoft Build - Seattle and Online - 21-23rd May 2024 Taking place on 21-23rd May 2024 both online and in Seattle, this is the perfect event to learn more about low code development, creating copilots, cloud platforms, and so much more to help you unleash the power of AI.   There's a serious wealth of talent speaking across the three days, including the likes of Satya Nadella, Amanda K. Silver, Scott Guthrie, Sarah Bird, Charles Lamanna, Miti J., Kevin Scott, Asha Sharma, Rajesh Jha, Arun Ulag, Clay Wesener, and many more.   And don't worry if you can't make it to Seattle, the event will be online and totally free to join. Click the image below to register for #MSBuild today!     European Collab Summit - Germany - 14-16th May 2024 The clock is counting down to the amazing European Collaboration Summit, which takes place in Germany May 14-16, 2024. #CollabSummit2024 is designed to provide cutting-edge insights and best practices into Power Platform, Microsoft 365, Teams, Viva, and so much more. There's a whole host of experts speakers across the three-day event, including the likes of Vesa Juvonen, Laurie Pottmeyer, Dan Holme, Mark Kashman, Dona Sarkar, Gavin Barron, Emily Mancini, Martina Grom, Ahmad Najjar, Liz Sundet, Nikki Chapple, Sara Fennah, Seb Matthews, Tobias Martin, Zoe Wilson, Fabian Williams, and many more.   Click the image below to find out more about #ECS2024 and register today!   Microsoft 365 & Power Platform Conference - Seattle - 3-7th June If you're looking to turbo boost your Power Platform skills this year, why not take a look at everything TechCon365 has to offer at the Seattle Convention Center on June 3-7, 2024.   This amazing 3-day conference (with 2 optional days of workshops) offers over 130 sessions across multiple tracks, alongside 25 workshops presented by Power Platform, Microsoft 365, Microsoft Teams, Viva, Azure, Copilot and AI experts. There's a great array of speakers, including the likes of Nirav Shah, Naomi Moneypenny, Jason Himmelstein, Heather Cook, Karuana Gatimu, Mark Kashman, Michelle Gilbert, Taiki Y., Kristi K., Nate Chamberlain, Julie Koesmarno, Daniel Glenn, Sarah Haase, Marc Windle, Amit Vasu, Joanne C Klein, Agnes Molnar, and many more.   Click the image below for more #Techcon365 intel and register today!   For more events, click the image below to visit the Microsoft Community Days website.    

Tuesday Tip | Update Your Community Profile Today!

It's time for another TUESDAY TIPS, your weekly connection with the most insightful tips and tricks that empower both newcomers and veterans in the Power Platform Community! Every Tuesday, we bring you a curated selection of the finest advice, distilled from the resources and tools in the Community. Whether you’re a seasoned member or just getting started, Tuesday Tips are the perfect compass guiding you across the dynamic landscape of the Power Platform Community.   We're excited to announce that updating your community profile has never been easier! Keeping your profile up to date is essential for staying connected and engaged with the community.   Check out the following Support Articles with these topics: Accessing Your Community ProfileRetrieving Your Profile URLUpdating Your Community Profile Time ZoneChanging Your Community Profile Picture (Avatar)Setting Your Date Display Preferences Click on your community link for more information: Power Apps, Power Automate, Power Pages, Copilot Studio   Thank you for being an active part of our community. Your contributions make a difference! Best Regards, The Community Management Team

Hear what's next for the Power Up Program

Hear from Principal Program Manager, Dimpi Gandhi, to discover the latest enhancements to the Microsoft #PowerUpProgram, including a new accelerated video-based curriculum crafted with the expertise of Microsoft MVPs, Rory Neary and Charlie Phipps-Bennett. If you’d like to hear what’s coming next, click the link below to sign up today! https://aka.ms/PowerUp  

Tuesday Tip: Community User Groups

It's time for another TUESDAY TIPS, your weekly connection with the most insightful tips and tricks that empower both newcomers and veterans in the Power Platform Community! Every Tuesday, we bring you a curated selection of the finest advice, distilled from the resources and tools in the Community. Whether you’re a seasoned member or just getting started, Tuesday Tips are the perfect compass guiding you across the dynamic landscape of the Power Platform Community.   As our community family expands each week, we revisit our essential tools, tips, and tricks to ensure you’re well-versed in the community’s pulse. Keep an eye on the News & Announcements for your weekly Tuesday Tips—you never know what you may learn!   Today's Tip: Community User Groups and YOU Being part of, starting, or leading a User Group can have many great benefits for our community members who want to learn, share, and connect with others who are interested in the Microsoft Power Platform and the low-code revolution.   When you are part of a User Group, you discover amazing connections, learn incredible things, and build your skills. Some User Groups work in the virtual space, but many meet in physical locations, meaning you have several options when it comes to building community with people who are learning and growing together!   Some of the benefits of our Community User Groups are: Network with like-minded peers and product experts, and get in front of potential employers and clients.Learn from industry experts and influencers and make your own solutions more successful.Access exclusive community space, resources, tools, and support from Microsoft.Collaborate on projects, share best practices, and empower each other. These are just a few of the reasons why our community members love their User Groups. Don't wait. Get involved with (or maybe even start) a User Group today--just follow the tips below to get started.For current or new User Group leaders, all the information you need is here: User Group Leader Get Started GuideOnce you've kicked off your User Group, find the resources you need:  Community User Group ExperienceHave questions about our Community User Groups? Let us know! We are here to help you!

Super User of the Month | Ahmed Salih

We're thrilled to announce that Ahmed Salih is our Super User of the Month for April 2024. Ahmed has been one of our most active Super Users this year--in fact, he kicked off the year in our Community with this great video reminder of why being a Super User has been so important to him!   Ahmed is the Senior Power Platform Architect at Saint Jude's Children's Research Hospital in Memphis. He's been a Super User for two seasons and is also a Microsoft MVP! He's celebrating his 3rd year being active in the Community--and he's received more than 500 kudos while authoring nearly 300 solutions. Ahmed's contributions to the Super User in Training program has been invaluable, with his most recent session with SUIT highlighting an incredible amount of best practices and tips that have helped him achieve his success.   Ahmed's infectious enthusiasm and boundless energy are a key reason why so many Community members appreciate how he brings his personality--and expertise--to every interaction. With all the solutions he provides, his willingness to help the Community learn more about Power Platform, and his sheer joy in life, we are pleased to celebrate Ahmed and all his contributions! You can find him in the Community and on LinkedIn. Congratulations, Ahmed--thank you for being a SUPER user!  

Top Solution Authors
Top Kudoed Authors
Users online (6,198)