cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
mpil
Frequent Visitor

[Permissions] Record level security in approval system

Hello everyone, 


I am kinda newbie in CDS and I am trying to wrap my head around security concepts so please bear with me if something seems obvious. 

Scenario:
I am building an approval system that will automate some manual work done by a team:

  • Every quarter there is a set of requests (let's say it's holiday requests) that are being send to the team 
  • Team is responsible for pre-processing of the data, adds additional information, etc.. This part is manual for the time being, but will be automated at a later stage. The result is an Excel file with all the necessary information.
  • Process of importing the requests to the system should be automatic and should trigger Approval process on record creation
  • Based on the properties, request is sent to relevant approvers for verification 

Idea is to use PowerApps + CDS + PowerAutomate

Problem:
Access is granted to individuals, e.g. person assigned as a next approver in the process should have explicit access to a record he is responsible for reviewing. After approving, request goes to another person and so on. Some persons in the process can edit the request, some are just reading. 
 
Initially I thought that I should define Team Templates with different access levels and add users to that Teams by the time the record is created. This could be handled by Power Automate. The issue is that I can't find any way to make that process automatic using OOTB way? As far as I understand this scenario is achievable using API call to CDS (https://github.com/microsoft/PowerApps-Samples/blob/master/cds/orgsvc/C%23/GrantModifyRevokeAccess/G...) but intention is to use OOTB features as much as possible. Additionally, this would create system-managed team for each record which sounds like not really a best idea, but maybe it's the only way of achieving this?

Do you have any suggestions of how to approach this? I am also considering using SQL, but CDS sounded like a good fit and could solve the permissions using internal mechanisms. 
I will be thankful for any tips. 

 

Cheers,

Marcin

1 ACCEPTED SOLUTION

Accepted Solutions
jlindstrom
Community Champion
Community Champion

for the people who always need access, just give them a security role that gives them org level.

for the users who should see based on properties, the easiest is team ownership (and as mentioned share with original owner and assign to team that  dynamically)

 

For access team automation, your biggest issue is that the team doesn't get created until the first person is added to it. We have worked around that with a synchronous plugin that adds the owner of the record to the team when the record is first created. this is not a OOTB feature though, it would require a developer.


 

View solution in original post

7 REPLIES 7
jlindstrom
Community Champion
Community Champion

so you only want people to have access to add information when it is their "turn?" meaning that when it's my turn to add details, I should be able to edit, but when it's not I shouldn't be able to?

 

One way to make this more automated and clean would to be to give the different roles different apps--one for requestor, one for update team, one for approvers. Especially with canvas apps, too many personas can be problematic.

 

So you could totally cut out the excel part by having a simple app (or even a Microsoft form/forms pro form so they wouldn't need a license) that requestors can use to submit the request. Then store this record in CDS directly using Power Automate (forms pro is automatically stored in CDS).

 

Then you need to just worry about the update team and the approvers. You can handle the variable security of the update team by assigning the request to the team--that would then give the team the way to update the details, then when they submit, you could change the ownership, and now they can't update it.

 

There are more advanced ways to handle the security, such as automated sharing and unsharing, but I don't like that because it is messy.

Thanks @jlindstrom  for the answer. 


Actually they use Forms to gather the requests, but the data needs to be enriched with data coming from internal systems which can't be automated due to some internal policies. If this can be fixed then it would be matter of adding flow that will do this automatically and create entry in CDS.

So you are suggesting to update Owner field at each stage of the process so current "Assigned" user would be able to update the request? How About other users that need to have Read access to the request, regardless of the Stage it is? The problem is that they may vary depending on the request properties. I could add additional app for "Request viewers" but as far as I know I would only be able to filter the data based on currently logged in user, so it will show requests relevant to him, but he will still be able to access CDS to look for entries by himself. As we are dealing with sensitive data, the accesses need to be assigned carefully. 

jlindstrom
Community Champion
Community Champion

>> How About other users that need to have Read access to the request, regardless of the Stage it is? 

How do you determine who needs access to which requests? Are these users who have access to all requests? if so, you can handle that with their security role and give them organization read access. If there are people who need to read all requests of a certain type, then you can create owner teams and assign or share the records with them.

 

Rule #1 is design for the main process, then add the exceptions.

 

You can filter and build views off of any user field, not just owner. There has to be some kind of rhyme or reason to who should have access to which requests.

 

Could be something like this:

 

Add a requestor field and make the requestor the owner when it is originally created.

Set this setting to yes so the original owner gets the record shared with them: https://www.crminnovation.com/blog/assigning-records-to-new-owners-what-happens-to-the-old-owner/

Based on parameters, reassign the record to the appropriate team that has the people who need to see or edit it.

 

On the other hand, if the people who should have access are dynamically determined in an ad-hoc manner, you can use access teams and define the people who should see or have access to edit the records by populating a grid on the record https://www.bing.com/search?q=access+teams+dynamics+365&cvid=47859182f4464947aa1a5631f6849454&FORM=A...

 

 

 

 

 

 

 

>>How do you determine who needs access to which requests? Are these users who have access to all requests?
General rules are like below:

  • There are several roles who should have access to all Requests for reading/editing
  • At the same time there are users who should have access for editing or reading only, for specific requests, based on properties of the request. Examples:

1. Request has field "Department" with value "HR" and another field "Business unit" with value "Sales". It means that specific person responsible for HR Department and another person responsible for Sales Business Unit should have read/write accesses
2. Another request has field "Department" with value "IT" and another field "Business unit" with value "Development". Different people will be assigned accordingly. At the same time person responsible for IT can't see requests coming from HR and so on. 

>> On the other hand, if the people who should have access are dynamically determined in an ad-hoc manner, you can use access teams and define the people who should see or have access to edit the records by populating a grid on the record

I was thinking about using access teams, but the main problem I faced was how to add users automatically by the time the record is created, assuming that Flow will be creating these records as a result of importing requests from Excel. As I understand the only way to achieve this is to call CDS API?

>>How do you determine who needs access to which requests? Are these users who have access to all requests?
General rules are like below:

  • There are several roles who should have access to all Requests for reading/editing
  • At the same time there are users who should have access for editing or reading only, for specific requests, based on properties of the request. Examples:

1. Request has field "Department" with value "HR" and another field "Business unit" with value "Sales". It means that specific person responsible for HR Department and another person responsible for Sales Business Unit should have read/write accesses
2. Another request has field "Department" with value "IT" and another field "Business unit" with value "Development". Different people will be assigned accordingly. At the same time person responsible for IT can't see requests coming from HR and so on. 

>> On the other hand, if the people who should have access are dynamically determined in an ad-hoc manner, you can use access teams and define the people who should see or have access to edit the records by populating a grid on the record

I was thinking about using access teams, but the main problem I faced was how to add users automatically by the time the record is created, assuming that Flow will be creating these records as a result of importing requests from Excel. As I understand the only way to achieve this is to call CDS API?

jlindstrom
Community Champion
Community Champion

for the people who always need access, just give them a security role that gives them org level.

for the users who should see based on properties, the easiest is team ownership (and as mentioned share with original owner and assign to team that  dynamically)

 

For access team automation, your biggest issue is that the team doesn't get created until the first person is added to it. We have worked around that with a synchronous plugin that adds the owner of the record to the team when the record is first created. this is not a OOTB feature though, it would require a developer.


 

Thanks @jlindstrom this gives me a solid understanding of how it may be approached. Cheers!


Helpful resources

Announcements

April 2024 Commnuity Newsletter

We're pleased to share the April Community Newsletter, where we highlight the latest news, product releases, upcoming events, and the amazing work of our outstanding Community members.   If you're new to the Community, please make sure to follow the latest News & Announcements and check out the Community on LinkedIn as well! It's the best way to stay up-to-date with all the news from across Microsoft Power Platform and beyond.    COMMUNITY HIGHLIGHTS   Check out the most active community members of the last month! These hardworking members are posting regularly, answering questions, kudos, and providing top solutions in their communities. We are so thankful for each of you--keep up the great work! If you hope to see your name here next month, follow these awesome community members to see what they do!   Power AppsPower AutomateCopilot StudioPower PagesWarrenBelzDeenujialexander2523ragavanrajanLaurensMManishSolankiMattJimisonLucas001AmikcapuanodanilostephenrobertOliverRodriguestimlAndrewJManikandanSFubarmmbr1606VishnuReddy1997theMacResolutionsVishalJhaveriVictorIvanidzejsrandhawahagrua33ikExpiscornovusFGuerrero1PowerAddictgulshankhuranaANBExpiscornovusprathyooSpongYeNived_Nambiardeeksha15795apangelesGochixgrantjenkinsvasu24Mfon   LATEST NEWS Business Applications Launch Event - On Demand In case you missed the Business Applications Launch Event, you can now catch up on all the announcements and watch the entire event on-demand inside Charles Lamanna's latest cloud blog.   This is your one stop shop for all the latest Copilot features across Power Platform and #Dynamics365, including first-hand looks at how companies such as Lenovo, Sonepar, Ford Motor Company, Omnicom and more are using these new capabilities in transformative ways. Click the image below to watch today!     Power Platform Community Conference 2024 is here! It's time to look forward to the next installment of the Power Platform Community Conference, which takes place this year on 18-20th September 2024 at the MGM Grand in Las Vegas!   Come and be inspired by Microsoft senior thought leaders and the engineers behind the #PowerPlatform, with Charles Lamanna, Sangya Singh, Ryan Cunningham, Kim Manis, Nirav Shah, Omar Aftab and Leon Welicki already confirmed to speak. You'll also be able to learn from industry experts and Microsoft MVPs who are dedicated to bridging the gap between humanity and technology. These include the likes of Lisa Crosbie, Victor Dantas, Kristine Kolodziejski, David Yack, Daniel Christian, Miguel Félix, and Mats Necker, with many more to be announced over the coming weeks.   Click here to watch our brand-new sizzle reel for #PPCC24 or click the image below to find out more about registration. See you in Vegas!     Power Up Program Announces New Video-Based Learning Hear from Principal Program Manager, Dimpi Gandhi, to discover the latest enhancements to the Microsoft #PowerUpProgram. These include a new accelerated video-based curriculum crafted with the expertise of Microsoft MVPs, Rory Neary and Charlie Phipps-Bennett. If you’d like to hear what’s coming next, click the image below to find out more!     UPCOMING EVENTS Microsoft Build - Seattle and Online - 21-23rd May 2024 Taking place on 21-23rd May 2024 both online and in Seattle, this is the perfect event to learn more about low code development, creating copilots, cloud platforms, and so much more to help you unleash the power of AI.   There's a serious wealth of talent speaking across the three days, including the likes of Satya Nadella, Amanda K. Silver, Scott Guthrie, Sarah Bird, Charles Lamanna, Miti J., Kevin Scott, Asha Sharma, Rajesh Jha, Arun Ulag, Clay Wesener, and many more.   And don't worry if you can't make it to Seattle, the event will be online and totally free to join. Click the image below to register for #MSBuild today!     European Collab Summit - Germany - 14-16th May 2024 The clock is counting down to the amazing European Collaboration Summit, which takes place in Germany May 14-16, 2024. #CollabSummit2024 is designed to provide cutting-edge insights and best practices into Power Platform, Microsoft 365, Teams, Viva, and so much more. There's a whole host of experts speakers across the three-day event, including the likes of Vesa Juvonen, Laurie Pottmeyer, Dan Holme, Mark Kashman, Dona Sarkar, Gavin Barron, Emily Mancini, Martina Grom, Ahmad Najjar, Liz Sundet, Nikki Chapple, Sara Fennah, Seb Matthews, Tobias Martin, Zoe Wilson, Fabian Williams, and many more.   Click the image below to find out more about #ECS2024 and register today!   Microsoft 365 & Power Platform Conference - Seattle - 3-7th June If you're looking to turbo boost your Power Platform skills this year, why not take a look at everything TechCon365 has to offer at the Seattle Convention Center on June 3-7, 2024.   This amazing 3-day conference (with 2 optional days of workshops) offers over 130 sessions across multiple tracks, alongside 25 workshops presented by Power Platform, Microsoft 365, Microsoft Teams, Viva, Azure, Copilot and AI experts. There's a great array of speakers, including the likes of Nirav Shah, Naomi Moneypenny, Jason Himmelstein, Heather Cook, Karuana Gatimu, Mark Kashman, Michelle Gilbert, Taiki Y., Kristi K., Nate Chamberlain, Julie Koesmarno, Daniel Glenn, Sarah Haase, Marc Windle, Amit Vasu, Joanne C Klein, Agnes Molnar, and many more.   Click the image below for more #Techcon365 intel and register today!   For more events, click the image below to visit the Microsoft Community Days website.    

Tuesday Tip | Update Your Community Profile Today!

It's time for another TUESDAY TIPS, your weekly connection with the most insightful tips and tricks that empower both newcomers and veterans in the Power Platform Community! Every Tuesday, we bring you a curated selection of the finest advice, distilled from the resources and tools in the Community. Whether you’re a seasoned member or just getting started, Tuesday Tips are the perfect compass guiding you across the dynamic landscape of the Power Platform Community.   We're excited to announce that updating your community profile has never been easier! Keeping your profile up to date is essential for staying connected and engaged with the community.   Check out the following Support Articles with these topics: Accessing Your Community ProfileRetrieving Your Profile URLUpdating Your Community Profile Time ZoneChanging Your Community Profile Picture (Avatar)Setting Your Date Display Preferences Click on your community link for more information: Power Apps, Power Automate, Power Pages, Copilot Studio   Thank you for being an active part of our community. Your contributions make a difference! Best Regards, The Community Management Team

Hear what's next for the Power Up Program

Hear from Principal Program Manager, Dimpi Gandhi, to discover the latest enhancements to the Microsoft #PowerUpProgram, including a new accelerated video-based curriculum crafted with the expertise of Microsoft MVPs, Rory Neary and Charlie Phipps-Bennett. If you’d like to hear what’s coming next, click the link below to sign up today! https://aka.ms/PowerUp  

Tuesday Tip: Community User Groups

It's time for another TUESDAY TIPS, your weekly connection with the most insightful tips and tricks that empower both newcomers and veterans in the Power Platform Community! Every Tuesday, we bring you a curated selection of the finest advice, distilled from the resources and tools in the Community. Whether you’re a seasoned member or just getting started, Tuesday Tips are the perfect compass guiding you across the dynamic landscape of the Power Platform Community.   As our community family expands each week, we revisit our essential tools, tips, and tricks to ensure you’re well-versed in the community’s pulse. Keep an eye on the News & Announcements for your weekly Tuesday Tips—you never know what you may learn!   Today's Tip: Community User Groups and YOU Being part of, starting, or leading a User Group can have many great benefits for our community members who want to learn, share, and connect with others who are interested in the Microsoft Power Platform and the low-code revolution.   When you are part of a User Group, you discover amazing connections, learn incredible things, and build your skills. Some User Groups work in the virtual space, but many meet in physical locations, meaning you have several options when it comes to building community with people who are learning and growing together!   Some of the benefits of our Community User Groups are: Network with like-minded peers and product experts, and get in front of potential employers and clients.Learn from industry experts and influencers and make your own solutions more successful.Access exclusive community space, resources, tools, and support from Microsoft.Collaborate on projects, share best practices, and empower each other. These are just a few of the reasons why our community members love their User Groups. Don't wait. Get involved with (or maybe even start) a User Group today--just follow the tips below to get started.For current or new User Group leaders, all the information you need is here: User Group Leader Get Started GuideOnce you've kicked off your User Group, find the resources you need:  Community User Group ExperienceHave questions about our Community User Groups? Let us know! We are here to help you!

Super User of the Month | Ahmed Salih

We're thrilled to announce that Ahmed Salih is our Super User of the Month for April 2024. Ahmed has been one of our most active Super Users this year--in fact, he kicked off the year in our Community with this great video reminder of why being a Super User has been so important to him!   Ahmed is the Senior Power Platform Architect at Saint Jude's Children's Research Hospital in Memphis. He's been a Super User for two seasons and is also a Microsoft MVP! He's celebrating his 3rd year being active in the Community--and he's received more than 500 kudos while authoring nearly 300 solutions. Ahmed's contributions to the Super User in Training program has been invaluable, with his most recent session with SUIT highlighting an incredible amount of best practices and tips that have helped him achieve his success.   Ahmed's infectious enthusiasm and boundless energy are a key reason why so many Community members appreciate how he brings his personality--and expertise--to every interaction. With all the solutions he provides, his willingness to help the Community learn more about Power Platform, and his sheer joy in life, we are pleased to celebrate Ahmed and all his contributions! You can find him in the Community and on LinkedIn. Congratulations, Ahmed--thank you for being a SUPER user!  

Tuesday Tip: Getting Started with Private Messages & Macros

Welcome to TUESDAY TIPS, your weekly connection with the most insightful tips and tricks that empower both newcomers and veterans in the Power Platform Community! Every Tuesday, we bring you a curated selection of the finest advice, distilled from the resources and tools in the Community. Whether you’re a seasoned member or just getting started, Tuesday Tips are the perfect compass guiding you across the dynamic landscape of the Power Platform Community.   As our community family expands each week, we revisit our essential tools, tips, and tricks to ensure you’re well-versed in the community’s pulse. Keep an eye on the News & Announcements for your weekly Tuesday Tips—you never know what you may learn!   This Week's Tip: Private Messaging & Macros in Power Apps Community   Do you want to enhance your communication in the Community and streamline your interactions? One of the best ways to do this is to ensure you are using Private Messaging--and the ever-handy macros that are available to you as a Community member!   Our Knowledge Base article about private messaging and macros is the best place to find out more. Check it out today and discover some key tips and tricks when it comes to messages and macros:   Private Messaging: Learn how to enable private messages in your community profile and ensure you’re connected with other community membersMacros Explained: Discover the convenience of macros—prewritten text snippets that save time when posting in forums or sending private messagesCreating Macros: Follow simple steps to create your own macros for efficient communication within the Power Apps CommunityUsage Guide: Understand how to apply macros in posts and private messages, enhancing your interaction with the Community For detailed instructions and more information, visit the full page in your community today:Power Apps: Enabling Private Messaging & How to Use Macros (Power Apps)Power Automate: Enabling Private Messaging & How to Use Macros (Power Automate)  Copilot Studio: Enabling Private Messaging &How to Use Macros (Copilot Studio) Power Pages: Enabling Private Messaging & How to Use Macros (Power Pages)

Users online (4,472)