cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
AnnaBrodnicki
Advocate II
Advocate II

Prevent people from accessing SharePoint list that the PowerApp is connected to

I'm building a marketing studio time request app that doesn't contain personal information but business sensitive information from the point of view that we don't want people to see other people's submissions due to the inernal politics that might result from it.

 

I am setting up the powerapp so that staff can submit their time requests and then can go back into the app and view/edit their own submissions only using a formula based on user.  The data source is a SharePoint list.  I understand that in order to add/edit from the PowerApp they need to have the relevant permissions for list in SharePoint.  

 

So the PowerApp will act as the front end for the submissions and the SharePoint list will act as the back end for the team processing the submissions.

 

I don't want people in the organisation to be able to access the SharePoint list and view other people's submissions/list items or have the ability to edit other people's submissions/list items.

 

I could hide the SharePoint list as much as I can by not having it on navigations etc and even create a default view that contains bare minimum info in case someone does navigate there but I feel it's still open to being discovered and information viewed.  This is a worry for any future apps that I might create that contain personal data or business sensitive information.

 

Does anyone have any suggestions about the best way to control this and prevent people from accessing the Sharepoint list that the PowerApp is connected to? 

 

Thanks,

 

Anna

46 REPLIES 46

That's actually a good idea. I'm gonna give it a try, Good job.

Hi Adam,

 

Thanks for this, it seems to be working well for me, have you had any issues since using this approach?

 

Have been looking for a way to secure the sharepoint lists in case anyone stumbles across them so thanks again

 

Regards

Ryan

Hi,

 

I have use the sharepoint list as a datasource to store the file attachments from powerapps.

I need to give the access for the users to download and upload the file attachments from powerapps only. but they should not access the sharepoint list URL.

I have tried your steps. but it wont works for me. do you any other solution??

 

 

Thanks in advance,

 

Anonymous
Not applicable

@Adam_116 : Thanks for the solution. 

 

For point 5: "For the concerned lists give the Visitors user group Contribute access to the the list.", I don't see any option on Sharepoint to change the Permission level of Visitors group from Read to Contribute. Could you pls let me know how to do that?

 

Thanks!

This is awesome @Adam_116 , I've done some basic tests (single lines of text column data and uploading attachments) and it works well. I re-wrote your guide so I can use it later, just a bit more verbose, hope you don't mind...

 

Hiding SharePoint lists that are used as datasources in PowerApps.

 

Do you have a PowerApp that uses SharePoint lists as datasources, and you don't want the users of the PowerApp to be able to view the SharePoint site/lists?


This sets up the SharePoint site/lists so that the PowerApp users can't view the SharePoint site or lists, but they can still perform read/add/edit functions from within the PowerApp.
(You need to be an owner of the SharePoint site to do this, not just a member).

 

1) Modify the 'Read' permissions level for the site.

  • Cog - Site Permissions
  • Advanced Permission settings
  • Ribbon - Permission levels
  • Read
  • Uncheck EVERYTHING except...
    a) SITE PERMISSIONS: "Open - Allows users to open a Web site, list, or folder in order to access items inside that container."

* this means any group or person with read access won't have access to anything (site, pages, libraries, lists ... everything)

 

2) Modify the 'Contribute' permissions level for the site.

  • Cog - Site Permissions
  • Advanced Permission settings
  • Ribbon - Permission levels
  • Contribute
  • Uncheck EVERYTHING except...
    a) LIST PERMISSIONS: "View Items - View items in lists and documents in document libraries."
    b) LIST PERMISSIONS: "Edit Items - Edit items in lists, edit documents in document libraries, and customize Web Part Pages in document libraries."
    c) LIST PERMISSIONS: "Add Items - Add items to lists and add documents to document libraries."
    d) SITE PERMISSIONS: "Open - Allows users to open a Web site, list, or folder in order to access items inside that container." (might have automatically been selected from the list selections)
    e) SITE PERMISSIONS: "View Pages - View pages in a Web site." (might have automatically been selected from the list selections)

* sets the Contribute permission level so that it allows reading/adding/editing list items

 

3) Stop inheriting permissions on the lists used by the PowerApp

  • Go to list/s
  • Cog - List Settings
  • Permissions for this list
  • Ribbon - Stop Inheriting Permissions - OK

* so we can set special permissions for the lists used by the PowerApp

 

4) For the concerned lists change the Visitors user group access from Read to Contribute access.

  • Go to list/s
  • Cog - List Settings
  • SiteName Visitors - check the checkbox
  • Ribbon - Edit User Permissions
  • Uncheck Read
  • Check Contribute

* sets up the Visitors user group to be the group we put the PowerApp users in. This group now has special access to the required list/s, but still only has read access to the rest of the site.

 

5) Add the PowerApp users to the 'Site Visitors' group

  • Cog - Site Permissions
  • Advanced Permission settings
  • SiteName Visitors
  • Add people

* these are the people who will have the ability to read/add/edit list items (from the PowerApp only!) but if they try and view the SharePoint site or list, they won't have access! Perfect!

 

So finally, we've set up the SharePoint site so any people added to the Visitors group will get read access across the site which we've modified so they won't see any of the site or lists (will be prompted to request access). However, for certain lists (the ones we as PowerApp datasources), the permission inheritance has been broken and we're applying a special (modified) Contribute permission which allows the users to perform the read/add/edit functions when they are in the PowerApp.
Owners and Members (users in the owners [full control] and members [edit] groups) will have the same access they always had.

@Adam_116  @stevegeall thank you both it worked. I created two new permission READ and WRITE instead of updating the default read and contributor permission. Thank you both!

Anonymous
Not applicable

Looking for this solution and landed on this solution - thanks!  One slight difference below:

 

Site owners - should be able to do anything they want (me and 3 others)

Product Mgmt - no direct edit of records in the SP list, only thru the PowerApp.  BUT, this group must be able to view the list and export it to XLS

Other users - no direct edit of records in the SP list, only thru the PowerApp

 

What do I need to do differently to allow for this?  I am very new to SP lists permissions, so apologies if this is a total newbie question, but newbie am I!  

These tweaks work a treat in the SharePoint List and PowerApps, however how do you stop someone from accessing it all through Power BI/Excel?

Anonymous
Not applicable

in case edit rights to creator, creator may temper information

HI Adam,

 

I tired the same thing but users are still able to view and edit sharepoint list via browsing. 

 

can you please give me more information?   have you got any contact details ??

 

Thanks

NIhil

Helpful resources

Announcements

Join Us for the First-Ever Biz Apps Community User Group Meeting: Live from MPPC23

  Join us for the first-ever the Biz Apps Community User Group meeting live from the Power Platform Conference! This one hour user group meeting is all about discovering the value and benefits of User Groups! Discover how you can find a group in your local area or about specific topics where you can learn new skills and meet like-minded people as a user group member.   Hear from User Group leaders about why they do what they do and what resources they receive to help them succeed as community ambassadors. If you have never attended a User Group meeting before, this will be a great introduction! We hope you are inspired to find a group that meets your unique interests!   October 5th at 2:15 pm Pacific time   If you're attending #MPPC23 in Las Vegas, join us in person! Find out more here: https://powerplatformconf.com/#!/session/Biz%20Apps%20Community%20User%20Group%20Meeting%20-%20Live%20from%20MPPC/6172   Not at MPPC23? Attend vvirtually by registering here: https://aka.ms/MPPCusergroupmeeting2023    If you can't attend this meeting live, don't worry! We will record this meeting and share it with the Community at powerusers.microsoft.com 

Back to Basics: Tuesday Tip #1: All About YOUR Community Account

We are excited to kick off our new #TuesdayTIps series, "Back to Basics." This weekly series is our way of helping the amazing members of our community--both new members and seasoned veterans--learn and grow in how to best engage in the community! Each Tuesday, we will feature new areas of content that will help you best understand the community--from ranking and badges to profile avatars, from Super Users to blogging in the community. Our hope is that this information will help each of our community members grow in their experience with Power Platform, with the community, and with each other!     This Week's Tips: Account Support: Changing Passwords, Changing Email Addresses or Usernames, "Need Admin Approval," Etc.Wondering how to get support for your community account? Check out the details on these common questions and more. Just follow the link below for articles that explain it all.Community Account Support - Power Platform Community (microsoft.com)   All About GDPR: How It Affects Closing Your Community Account (And Why You Should Think Twice Before You Do)GDPR, the General Data Protection Regulation (GDPR), took effect May 25th 2018. A European privacy law, GDPR imposes new rules on companies and other organizations offering goods and services to people in the European Union (EU), or that collect and analyze data tied to EU residents. GDPR applies no matter where you are located, and it affects what happens when you decide to close your account. Read the details here:All About GDPR - Power Platform Community (microsoft.com)   Getting to Know You: Setting Up Your Community Profile, Customizing Your Profile, and More.Your community profile helps other members of the community get to know you as you begin to engage and interact. Your profile is a mirror of your activity in the community. Find out how to set it up, change your avatar, adjust your time zone, and more. Click on the link below to find out how:Community Profile, Time Zone, Picture (Avatar) & D... - Power Platform Community (microsoft.com)   That's it for this week. Tune in for more Tuesday Tips next Tuesday and join the community as we get "Back to Basics."

Power Platform Community Newsletter: September 2023

Welcome to our September 2023 Newsletter, where we highlight the latest news, product releases, podcasts, upcoming events, and the great work of our Power Platform Community members. As usual, please make sure you follow our News & Announcements in the Community to stay up to date. Another great way to connect is to join our Power Platform Community on LinkedIn. You can join our LInkedIn community here.   MPPC's Got Power - Submissions end September 28th! Are you ready to showcase your skills at the Microsoft Power Platform Conference in Las Vegas? Don't miss out on the "MPPC's Got Power" talent show, a grand celebration of connection, inspiration, and shared journeys. Whether you're a technical innovator, a talented storyteller, or have a hidden creative side, we want to see what you've got! With three categories to choose from, you have the chance to shine on stage and make your mark in the Microsoft Power Platform community.  Click the GIF to sign up by Thursday 28th September to be part of an unforgettable MPPC23 experience. Now is your time to shine!     Check Out the Low Code Approach Podcast Give the Low Code Approach Podcast a listen! Hosted by Sean Fiene, Wendy Haddad, and Kenric Auguillard, this innovative show shines a light on how Microsoft MVPs, product team members, and Community users are building exciting solutions using Microsoft Power Platform. Plus, with guests like Kartik Kanakasabesan, April Dunnam, Ricardo Duncan Jr., Sonja Gu, Phil Topness, Shane Young and more, this weekly show is a must for all you Business Applications enthusiasts out there. Click the image below to check it out!           COMMUNITY HIGHLIGHTS Check out the most active Community users for August 2023. These hardworking members are posting regularly, answering questions, writing blogs, giving kudos, and providing top solutions in their communities across Power Platform. Huge thanks to these amazing community members for their great contributions last month! trice602poweractivateLaurensMWarrenBelzAmikBCBuizerSamLedcreativeopinion timlExpiscornovusManishSolankiMattJimisonfernandosilvaMisterMarkPstork1saudali_25hafizsultan242Lucas001ragavanrajanp_doc   UPCOMING EVENT: 365 EDUCON CHICAGO Whether you're new to Microsoft 365, Power Platform and SharePoint, or an experienced power user, admin or developer, 365 EduCon has content designed to fit your experience level and area of interest. Their workshops and sessions are taught by Microsoft Certified Trainers, MVPs, Regional Directors, and Engineers. Find out more and register here: Home - Microsoft 365 EduCon Chicago - A Microsoft 365 Conference.  

Announcing the MPPC's Got Power Talent Show at #MPPC23

Are you attending the Microsoft Power Platform Conference 2023 in Las Vegas? If so, we invite you to join us for the MPPC's Got Power Talent Show!      Our talent show is more than a show—it's a grand celebration of connection, inspiration, and shared journeys. Through stories, skills, and collective experiences, we come together to uplift, inspire, and revel in the magic of our community's diverse talents. This year, our talent event promises to be an unforgettable experience, echoing louder and brighter than anything you've seen before.    We're casting a wider net with three captivating categories:  Demo Technical Solutions: Show us your Power Platform innovations, be it apps, flows, chatbots, websites or dashboards... Storytelling: Share tales of your journey with Power Platform. Hidden Talents: Unveil your creative side—be it dancing, singing, rapping, poetry, or comedy. Let your talent shine!    Got That Special Spark? A Story That Demands to Be Heard? Your moment is now!  🚀 Sign up to Showcase Your Brilliance: https://aka.ms/MPPCGotPowerSignUp  🔥 Deadline for submissions: Thursday, Sept 28th    How It Works:  Submit this form to sign up: https://aka.ms/MPPCGotPowerSignUp  We'll contact you if you're selected. Get ready to be onstage!  The Spotlight is Yours: Each participant has 3-5 minutes to shine, with insightful commentary from our panel of judges. We’re not just giving you a stage; we’re handing you the platform to make your mark.     Be the Story We Tell: Your talents and narratives will not just entertain but inspire, serving as the bedrock for our community’s future stories and successes.    Celebration, Surprises, and Connections: As the curtain falls, the excitement continues! Await surprise awards and seize the chance to mingle with industry experts, Microsoft Power Platform leaders, and community luminaries. It's not just a show; it's an opportunity to forge connections and celebrate shared successes.    Event Details:  📆 Date and Time: Wed Oct 4th, 6:30-9:00PM   📍 Location: MPPC23 at the MGM Grand, Las Vegas, NV, USA  

September User Group Success Story: Reading Dynamics 365 & Power Platform User Group

The Reading Dynamics 365 and Power Platform User Group is a community-driven initiative that started in September 2022. It has quickly earned recognition for its enthusiastic leadership and resilience in the face of challenges. With a focus on promoting learning and networking among professionals in the Dynamics 365 and Power Platform ecosystem, the group has grown steadily and gained a reputation for its commitment to its members!   The group, which had its inaugural event in January 2023 at the Microsoft UK Headquarters in Reading, has since organized three successful gatherings, including a recent social lunch. They maintain a regular schedule of four events per year, each attended by an average of 20-25 enthusiastic participants who enjoy engaging talks and, of course, pizza.     The Reading User Group's presence is primarily spread through LinkedIn and Meetup, with the support of the wider community. This thriving community is managed by a dedicated team consisting of Fraser Dear, Tim Leung, and Andrew Bibby, who serves as the main point of contact for the UK Dynamics 365 and Power Platform User Groups.   Andrew Bibby, an active figure in the Dynamics 365 and Power Platform community, nominated this group due to his admiration for the Reading UK User Group's efforts. He emphasized their remarkable enthusiasm and success in running the group, noting that they navigated challenges such as finding venues with resilience and smiles on their faces. Despite being a relatively new group with 20-30 members, they have managed to achieve high attendance at their meetings.   The group's journey began when Fraser Dear moved to the Reading area and realized the absence of a user group catering to professionals in the Dynamics 365 and Power Platform space. He reached out to Andrew, who provided valuable guidance and support, allowing the Reading User Group to officially join the UK Dynamics 365 and Power Platform User Groups community.   One of the group's notable achievements was overcoming the challenge of finding a suitable venue. Initially, their "home" was the Microsoft UK HQ in Reading. However, due to office closures, they had to seek a new location with limited time. Fortunately, a connection with Stephanie Stacey from Microsoft led them to Reading College and its Institute of Technology. The college generously offered them event space and support, forging a mutually beneficial partnership where the group promotes the Institute and encourages its members to support the next generation of IT professionals.   With the dedication of its leadership team, the Reading Dynamics 365 and Power Platform User Group is poised to continue growing and thriving! Their story exemplifies the power of community-driven initiatives and the positive impact they can have on professional development and networking in the tech industry. As they move forward with their upcoming events and collaborations with Reading College, the group is likely to remain a valuable resource for professionals in the Reading area and beyond.

A Celebration of What We've Achieved--And Announcing Our Winners

As the sun sets on the #SummerofSolutions Challenge, it's time to reflect and celebrate! The journey we embarked upon together was not just about providing answers – it was about fostering a sense of community, encouraging collaboration, and unlocking the true potential of the Power Platform tools.   From the initial announcement to the final week's push, the Summer of Solutions Challenge has been a whirlwind of engagement and growth. It was a call to action for every member of our Power Platform community, urging them to contribute their expertise, engage in discussions, and elevate collective knowledge across the community as part of the low-code revolution.   Reflecting on the Impact As the challenge ends, it's essential to reflect on the impact it’s had across our Power Platform communities: Community Resilience: The challenge demonstrated the resilience of our community. Despite geographical distances and diverse backgrounds, we came together to contribute, learn, and collaborate. This resilience is the cornerstone of our collective strength.Diverse Expertise: The solutions shared during the challenge underscore the incredible expertise within our community. From intricate technical insights to creative problem-solving, our members showcased their diverse skill sets, enhancing our community's depth.Shared Learning: Solutions spurred shared learning. They provided opportunities for members to grasp new concepts, expand their horizons, and uncover the Power Platform tools' untapped potential. This learning ripple effect will continue to shape our growth. Empowerment: Solutions empowered community members. They validated their knowledge, boosted their confidence, and highlighted their contributions. Each solution shared was a step towards personal and communal empowerment. We are proud and thankful as we conclude the Summer of Solutions Challenge. The challenge showed the potential of teamwork, the benefit of knowledge-sharing, and the resilience of our Power Platform community. The solutions offered by each member are more than just answers; they are the expression of our shared commitment to innovation, growth, and progress!   Drum roll, Please... And now, without further ado, it's time to announce the winners who have risen above the rest in the Summer of Solutions Challenge!   These are the top community users and Super Users who have not only earned recognition but have become beacons of inspiration for us all.   Power Apps Community:  Community User Winner: @SpongYe Super User Winner: Pending Acceptance Power Automate Community:  Community User Winner: @trice602 Super User Winner: @Expiscornovus  Power Virtual Agents Community: Community User Winner: Pending AcceptanceSuper User: Pending Acceptance Power Pages Community: Community User Winner: @OOlashyn Super User Winner: @ChristianAbata   We are also pleased to announced two additional tickets that we are awarding to the Overall Top Solution providers in the following communities:    Power Apps: @LaurensM   Power Automate: @ManishSolanki    Thank you for making this challenge a resounding success. Your participation has reaffirmed the strength of our community and the boundless potential that lies within each of us. Let's keep the spirit of collaboration alive as we continue on this incredible journey in Power Platform together.Winners, we will see you in Vegas! Every other amazing solutions superstar, we will see you in the Community!Congratulations, everyone!

Top Solution Authors
Top Kudoed Authors
Users online (2,599)