Users Don't Have Access to Data Even Though Sharepoint Lists Have Been Shared With Them

[Anonymous]

I have several PowerApps connected to SharePoint lists as their data sources. For each app, there I created a user group on the SharePoint site called "[App Name] Users". For each list that is connected to a given app, I have gone into list permissions, chosen "Stop inheriting permissions", and added the App user group to the permissions on the list with "Full Control." I do this because it limits the access that users have to data they don't need to see, and has worked for about 5 months so far.

Yesterday, I ran into some issues. The first was with one user. This user was part of the App User Group and had each list shared with her individually. I deleted her from the "individual share", but she was still added to the user group that had full control to each list (that had been working for everyone else). If she opened the SP list directly, she had full control. But, if she tried to go through the app, she got an error saying she didn't have permissions to the list.

After an hour of troubleshooting, I decided to reset all the permissions on the SP site and redo them, as I wanted to reorganize from the ground up. After doing this, all of my users lost access to their data. Even after re-sharing the lists with the same user groups as before, exactly how it was set up before, none of them are able to use the app.

I have tried everything I can think of. I refreshed the data sources in the apps and re-published them. In addition, I can no longer create a user group and share data through the app. Even creating a new user group, new sharepoint list, and new app (again, exactly as it was set up before when it worked), my users cannot use the app.

The only method I have found that works is to add users to the "Site Owners" user group, which, for obvious reasons, isn't an acceptable solution.

Am I missing something obvious, or is this a bug?

[Pstork1]

    There are a couple things that are combining to cause your issue.  The primary one being that the application is using OAUTH to access the SP lists and not using the user's authentication directly.  Users create an Oauth connection the first time they run an app. The app will continue to use that connection and the permissions associated with it until the connection times out or is removed and replaced. So one of your problems is that changing permissions on existing users won't change the OAuth connection used by the app.

I suspect another issue is that user group membership is cached and changes to existing groups may not be reflected by SharePoint for several hours.  So a lot of the changes you made to group membership may have worked if you waited overnight.

To fix it now I suspect you'll need to create new groups and assign them the permissions to the list, add the users to the groups, and create new connections in the apps so users are prompted for a new OAuth connection when they log into the apps again.

[Anonymous]

Thanks for your response, I didn't know about the OAUTH connection.

I have tried to create an entirely new app, new list, and new user group, though, with no success. Is there some kind of setting you need to enable in SP to enable PowerApps connections?

[Pstork1]

No special setting.  But you may be using an existing connection even in the new app. If you go to connections in the PowerApps web site you can see a list of connections and which apps are using each connection.

[Anonymous]

I just tried manually deleting the data connections in the app and re-adding them - it worked! Thank you so much for your help!

[Anonymous]

Sorry, this didn't actually work.

It appears that deleting and re-adding the connections has nothing to do with solving this issue.

Currently, if I add the user groups to have Full Access to the SharePoint site the lists are located in and have each list set to Inherit Permissions, my users gain access to the data in the app. This happens in real-time, less than a second after the change is made.

However, if I go into SharePoint after that and set the lists to Stop Inheriting Permissions, then remove access to the full site through the site's permissions settings, they instantly lose access. Even though the list permissions show that they still have Full Control access, they lose the permissions through PowerApps. Adding them back to the site's permissions instantly gives them access to the data again through PowerApps. I have tried deleting the connections in the apps and re-adding them between each step in this process to no avail.

[Pstork1 · Accepted solution]

Ok, let me try and take another stab at what I think is happening.  I just tested this and it works for me. I think the issue you are having is a misunderstanding of how SharePoint groups work in SharePoint, and not an actual problem with permissions.

• Permissions are granted to securable objects in SharePoint (sites, webs, lists, items) based on the intersection of three things.  The securable object, the user or SharePoint Group, and the permission level assigned.
• Permissions assigned at the root site of he site collection inherit down until they reach a spot where permission inheritance is broken.  When broken existing permissions are copied into the new settings creating he top of a new inheritance chain.
• Here's the key that I think is causing the problem.  Although groups can be created at any point in the hierarchy they are always scoped for the whole Site collection.  So if you break inheritance at the list level and remove a user from a group, you are removing that user from that group (and any permissions) anywhere in the hierarchy. So when you break inheritance in a list, and then go back to the top of the site and remove them from the group or delete the group then you delete their permissions related to that group everywhere.

Here's what I tested that works for me.

• I created a PowerApp based on a SharePoint list and shared it with a user.
• I went to the list and broke security inheritance. I then gave the user permissions to that list directly.  I could have also created a new group, put the user in the group, and given that group permission.
• I then went back to the top of the site and removed the user from the original group.

The user now has only limited permissions in the root site and contribute permissions to the list. The PowerApp works fine.

I think you have inadvertantly been removing the user's permission to the list when you change or delete the list at the site level.

[Anonymous]

This was close to the solution I found, and the way that it worked before I reset the permissions on my SP site. I found that I have to give my users at least "Restricted Interfaces for Translation" permissions to the main site in order for them to use the apps. I could follow those steps directly and it would work right up until the last step where you remove their access to the site-level, and then a user would instantly lose access to the data in the app.

I did notice that something is up with the "Limited Access" permission level after the reset. It doesn't seem to be generating properly when I grant access to a specific list like it did before. It's hard for me to tell, because I have very limited access to my SP site and I have to go through IT for some changes.

Regardless, you've taken a significant portion of your day to help me - thank you very much!

[Pstork1]

Users will need limited access at the site level, but that should be granted automatically when you break inheritance. It could be that something you are doing in your PowerApp requires the other permission, but limited access should normally be enough.