PowerApps and SharePoint Permissions: Access SharePoint site, but not view any lists, but be able to submit and write into a sharepoint list in the site.

[Phillip-JCI]

Hi guys, this is my use case:

I have a SharePoint site, I am sharing with everyone in the company domain.

I embeded the PowerApp application in the home page. The application is shared with everyone in PowerApps.

The powerapp application is essentially a form, that collects input, and saves it to a specific SharePoint list in the SharePoint site. I am using the Patch function to transfer the data.

Up to here it's fine.

The application uses 5 or so SharePoint Lists that are in contained in that sharepoint site. I set the permissions so that users can only Read. However that does not work, they can't submit their entries. I understand thats because they need to be able to edit that specific sharepoint list. If I give them edit access they can edit to their hearts content, and submissions work. However this is not good because I don't need them to see the sharepoint list which is essetially our entries database.

Ideal Scenario: What I'd like to do, is hide all sharepoint lists from everyone, so they can't edit it. They don't need to see them, only myself, and any other Admins, should be able to see/edit the lists.

My only solution this far, is give access, but in the sharepoint list, make it so they can only see their own submissions, but this isn't 100% ideal. Idealy they should not have access at all the the lists, but should be able to submit into them through the app.

Hopefully someone has run into this.

Thanks!

[Pstork1]

Sorry, but that is the way its designed to work and it really can't be changed.  PowerApps doesn't have an ability to do elevated permissions, so the person running the app has to have permissions to the backend data source.  If you want users to be able to edit items then they need edit permissions.  You can remove the lists from navigation and hide them, but you can't remove user's permissions.

[RezaDorrani · Accepted solution]

Hi @Phillip-JCI 

Your best bet would be to create an interim list where data is posted to by users and then write a Flow which moves the data to your controlled list

That ways, users only have access to the interim list and then the data is moved to your controlled list

Note: Users will not be able to see the data posted once the item moves to your controlled list (secured list)

Regards,

Reza Dorrani

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly

[Phillip-JCI]

Hi @Pstork1, that much I understand, but hiding it, to my understanding I can remove from showing up on the left panel. However they can still search for it right? That's my concern, I need to make it so someone can't manually edit those lists.

I don't mind that they have permission to access the lists, but I need to protect the integrity of the lists from user error, do you have a suggestion?

So far the only other option I can come up with, is create a seperate sharepoint site, and embed the app there. That way the users can't access the lists, though I don't know if them having access will make it so it shows they can access that sharepoint from somewhere.

I find it crazy that there's no easy way to do this, and its a security nightmare if you think about it, where all users could theorectically mess with the database.

Thanks!

[Pstork1]

The bottom line is that you'll need to trust yourr users.  Either they can edit the content of the list or they can't.  That's the way its designed to work.

• Yes, hiding the list won't keep them from editing it if they search for it.
• Putting it on another site won't help if you don't give them access to the lists they still won't be able to add or edit records.

SharePoint is and always has been about empowering end users to do things for themselves.  That means giving them the power to do things, even shoot themselves in the foot.  The way to fix that is by training the user's on how to use the tool, not by locking them out. (I'll get off my soapbox now.  Sorry if my rant offends someone.  I just don't agree that SharePoint (or PowerApps) has a problem because it doesn't do things the way that IT departments have always done them.)

[Phillip-JCI]

I understand the sentiment, but I will courtously disagree. Its about empowering the users to do things, which I am a power user, and I was able to develop a very fancy canvas app that will help the business tremendously. That's the point of powerapps.

However the lack of security parameters endangers the business. If you are business owner, and your money is on the line, you want to "trust" your users? What if your users are external? Not mention not counting malicious intent which could also happen.

PowerApps and SharePoint need to have the flexibility to do both. The reality is unfortunately you can't trust your users, especialy when I may have thousands accessing the app. I understand what you mean though.

I may have to do the flow suggestion and just transfer data to a controlled list. Disapointing that SharePoint doesn't have a built in solution for something so basic.

Thanks!