Login and Record Level Security

[Anonymous]

Hi!

I am considering moving from an app provider to PowerApps.

In my new app, I would like to have a login page and then display data and allow to access pages based on the user information. Can this be done in PowerApps?

Will all the users registered for my app need PowerApps licenses?

Thanks!

[Audrie-MSFT]

So, at first glance I would like to answer "Yes" to a few of your questions, but please bear with me that I need a bit of additional information:

1. When you say you would like to have your user log-in using a custom log-in screen; are you refering to users within your organization / tenant, or users outside of your organization?

2. When you say you'd like to give access to "screens" only to certain users; are you able to explicity reference User Names within the AAD, or are these users outside of your organization?

3. You can easily restrict certain data to users by only providing only certain data points within the app. I'm worried that you want the data view to be dynamic (not based on formulas that you use). In that case the data source would have to support RBS.

In my own practice I would take the following steps to restrict data visibility within my apps:

• I will restrict gallery and forms controls to show only the records needed by the application consumers. I purposely remove any columns or data they do not need within the application. However, this in itself does not protect the data source from discoverability by some other means.
• I will design screens for certain users which I ensure are discoverable only by those users. For example, screen3 of my app may have fields that are hidden in the content type on my SharePoint list, because they can be filled out by the 3 people that will navigate to that screen. Then I put a button on another screen that will navigate there....but very important: I also set the visible properly of that button so 'it' is only seen by those three users as well. As long as no one else can browse to those screens, I know that data is safe there (since I've hidden those columns on SharePoint from the end users editing the default form). But, this is only possible if the data source allows for this sort of configuration.

Please feel free to share screen shots of what you are trying to do so that our answers more accurately respond to your specific needs.

Thank you,

Audrie

[Anonymous]

Hi Audrie,

Thank you for your answer.

Users will be both within and outside of my organization.

Is it possible to register users outside of my organization in the AAD? If there is some kind of free license, I am willing to create user accounts for these people as if they were part of my organization, just so they can access the app.

I do not know if I can filter data by formula or not. This filtering is actually pretty simple. I have users from different organizations and I want the users to only see data related to their own organization.

For the screen access, I will have record levels for each app users (basic user, manager, and Admin). Obviously, the admin users will have access to screens that the basic users won't be able to see. All admins will be part of my organization, though. Please note that when I say "admin", I refer to the consumers of the app, not the design within PowerApps.

What do you mean by "restrict gallery and forms controls to show only the records needed by the application consumers" ? Is this similar to a SQL view? How can a user "hack" the app to see data belonging to someone else?

Thanks!