Sharing my APP

[sajarac]

Hi there,

Silly question here.

I have my app ready for distribution, under the powerapps setting I can easy assing to share with my entire organization, but once the users start using the app they get a notification "powerapps you don't have permission to view this data"

BTW my data is a Share point List.

I would like to add in my powerapp a specific group in my organization. and also in my share point list the same group.

Someone could point me in the right direction?

thanks in advance

[TimRohr]

Does the user have rights on the SharePoint side? The list will inherit rights unless you break the inheritance (and if you want to add specific rights to the list I think you *have* to break inheritance). Once you have the user (or group) added to have rights to the list in SharePoint, and since you've already shared the powerapps app to the user, you should be in business.

In SharePoint Online, go to the Settings for the List (click the 3 dots and choose Settings, or open the List and choose "List Settings" from the gear at the top of the screen). Then pick "Permissions for this list". That will get you to the screen where you can add or remove rights.

[sajarac]

Thank you very much for your prompt response. I don't have to much experience in SPL, but I can see the permissions for the list. But I will do my best to finish this.

Sorry to bother you, I just noticed when I was trying to fix this. I have another list in SP but that list is in a public group. I used another account to access the share sites in share point and I saw that list. so I was curious to see if I can see the data and modify something and in fact I did I was able to add a column in a list. so this mean every user can do that and the worst delete a column....OMG.

Do you know how can I fix this?

I mean change the atributes to read/write data but not full control

Thanks in advance

Regards,

[TimRohr]

You need to create a group for the consumption of the list versus the editing/control of the list. The group could be a domain group or a SharePoint group.

Note: If you're creating a SharePoint group, I'm a fan of either making the group the owner of itself, or creating a group to be the owner of the group... (where the owning/administering group would be the owner of itself). This gets past the problem of the Employee who owns the group leaving, and now you can't edit the group or access the list.

Add the necessary users to the "Use" group. Add the necessary users to the "Edit" group.

Then choose to "Stop Inheriting Permissions" and then add the appropriate permissions for the groups you created.

[sajarac]

Hi,

I have been reading and reading, sorry I don't get it. in a baby steps in SP.

[TimRohr]

OK... I can try. Not a SharePoint maven like some on here, but I can get it done. Be aware that -- this being Microsoft -- there are a dozen ways to get to whatever destination you're after. They are all about accessibility. Someone else might have another way to go about this. This is what works for me.

These screenshots and steps are from SharePoint online.

Go to your site. Click on the gear icon in the upper right, and choose "Site Settings".

You'll be taken to the Site Settings screen with many links. The links availalbe to you will depend on your authority on the site.

Choose Site Permissions to navigate to the Site Permissions page. There you will see on the ribbon the ability to Create a group. Click on that.

This is what you will use to create groups if necessary (like a "view" group versus an "editing/control"). This is also where you can set site-level permissions for various groups. This would be the first place to start in terms of who can access what. You can edit an existing group and grant or remove rights. (I'll keep going as if this level of control isn't enough, and for some reason you have to have more granular control over one list or another.)

If you have to create a group, it will have 1 owner. This can be a person or another group. You will default in as the Owner. Take it from personal experience, if you assign ownership away from yourself, you run the risk that you won't be able to edit that group. No fun. Extend that idea to where you imagine the Owner of a group leaving your company, and you see the inherent problems in a single-owner situation.

One solution is to make the Group the owner of itself (requires you to go back into the group after you have created it and replace the Owner value with the name of the Group), and give it rights to control membership. (You will see all of these options on the Create Group screen; if you need more explanation over any of these, you probably shouldn't be administering SharePoint yet. Just saying...)

Now make sure you are a member of the group. If someone leaves, you have other members of the Group who are still there. You can still control the membership.

This solution has problems because you don't always want members of a group to have control over who can be in the group. That's the whole reason for establishing Groups in the first place, to limit or grant rights. So let's extend the solution slightly.

I favor a model where, for any group of significant size or access (or significant limiting of access), we have an Administrative group to own/control/administer it. It could be the same admin group for all user groups, or it could be one admin group for each user group... ie, a ProductionListRead group could have a ProductionListAdmin group. We will figure that the users in the admin group are savvy, trusted, and empowered to view the data that they administer, so for the admin group, I *would* make the group the owner of itself.

So, getting back to the Permissions screen in SharePoint, create a group to be the Administrative group for your "Viewing" group. Give it rights to control membership, etc. As we are thinking about rights to manage specific lists, etc., we won't grant site-level permissions (at the bottom of the screen). Leave yourself as the Owner, and hit "Create". You will be taken to the "People and Groups" page for your new group. Click "New" and choose "Add Users to this Group." Step through the process. Pro-tip: in the pop-up window where you can add users, click on "SHOW OPTIONS" to deselect the "Send an email..." option.

Use the Gear in the upper right again, go to Site Settings, and then Permissions. Your Group will be listed there. Edit it, and now change the Owner to be the group, itself. Save the Group again.

Back at the Permissions page, Create another group, this one to be the "View" group for your list. Set the Owner to be the Admin group you previously created. Don't grant site-level permissions, and click "Create". Add the appropriate users.

Get back to the Permissions page and create another group, this one to be the "Edit/Design" group for your list. Same as for the "View" group, set the Owner to be the Admin group, don't grant site-level permissions, and click "Create". Add appropriate users.

Now you're ready to set permissions for your list.

Navigate to your Site Contents page, and find the list you're worried about. Let's pretend the name of the list is "Regions".

See the 3-dot menu? Click that to get a pop-up.

Choose "Settings". As an alternative, if you actually click on the List from here (so that you are viewing the List data/contents), you can use the same gear icon you used before (in the upper right of your site) to choose "List Settings".

That will take you to the List Settings page for that List. Find "Permissions for this list" and click on it.

You will see groups that have inherited rights to the List. You will probably see, then Groups that should NOT have access (based on what you describe). First step you will want to do is to click the button to "Stop Inheriting Permissions" on the ribbon.

Verify your choice (make sure you understand the implications first). You will be taken to pretty much the same screen, except the ribbon will update. You'll now have the option to "Delete unique permissions" and "Grant Permissions". Your exising Groups who previously had rights will be there, too. Their rights have been converted from Inherited to Unique (explicitly granted at this level/object). Selecting the checkbox next to any/all of them will enable more buttons on the ribbon ("Edit User Permissions" and "Remove User Permissions").

First, add rights to the new groups you have created by choosing "Grant Permissions" on the ribbon.

In the dialog box that pops up, enter the name of the view-group you created, and choose "SHOW OPTIONS". Again, since you are recreating rights, I would deselect the "Send Email" box. Select the appropriate level of permissions in the bottom dropdown (for this group, either View, Contribute, or Read, depending on your need). Click "Share".

Use the same process to "Grant Permissions" to your Edit group, selecting one of the higher level of permissions (Full Control, Design, or Edit).

Last, get back to the Permissions of the List (where you see the Groups & Users who have access), and remove the access from the entities that should not have access (all of the rights you were appalled to find your users had).

Hopefully this makes sense. I can't get much more step-by-step than this. Good luck!

[sajarac]

Wow, thank you very much for this very useful and complete guide. I really really appreciate your cooperation. I will start tryin this and I will update with the resutls.

Thanks in advance!!!!