Give Access to Power APP and its Sharepoint List problem

[EliasMerabet]

Hello Team,

After share my Power APP with my colleagues, I had to grant access to them to a few Sharepoint Lists. I manage the access to the lists inside the APP. But If the user get the Sharepoint List URL, doesn´t he change the lists outside the app? That could be problematic for me.

Thanks

[Pstork1 · Accepted solution]

Unfortunately, that is the way Power Apps is designed to work.  Power Apps is not a security layer so users need to have whatever permissions are necessary in the app for the back end data source.  You can't use SharePoint as a data source without giving users access to SharePoint.  So yes, if they get the URL for the list they would be able to bypass the app and make changes directly.  That's the way its designed to work and there is no real way to get around that.

[EliasMerabet]

Thanks @Pstork1 

[EliasMerabet]

Does it happen the same with a SQL connection? @Pstork1 

[Pstork1]

Not quite the same. The SQL connector uses a connection account with an embedded ID and password.  The user has access to the connection in Power Apps, but not outside.  So if they have access to create apps in Power Apps they can use the connection to create their own app.  But they have no direct access to SQL outside the Power App.

[EliasMerabet]

@Pstork1 Great! Thanks!

[svm75]

Hi, 

I assume it is still the same for SharePoint, is that different for Dataverse?

Thanks, SVM