cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
benji-7
Frequent Visitor

Share Dataverse row with user or group in Powerapps Canvas

Hallo,  I am working on an Powerapp where I create a row in a Dataverse table. For each row I create two groups in the "Team" table. Now the goal is that I share the created row with those two groups, one with read, the other with write permission. Is there a way to accomplish that with Powerapps using a Canvas App? 

 

The only thing I have read so far, was to use a flow with the  "perform unbound action".

 

Is there any other way to solve that?

 

Thank you for any help

5 REPLIES 5
dpoggemann
Super User
Super User

Hi @benji-7 ,


Can you explain more the "For each row I create two groups in the "Team" table?  Do you have two teams overall and for another table you want to be able to have one group with read permissions to all the records and another group have write permissions?  Is this different per record or consistent for all records that you are creating?

 

If this is consistent for all records I would do the following:

  1. Set the Owner of the record being created to the Team that has the Write capabilities.  You can then setup the role for this table that they can then modify their owned records and it will cover this
  2. The same role can be used for the users you want to be able to have "View" the records and you wouldn't need to share with the team at all, just the role assignment for Read being at Organization or Business Unit level and the users in this team would have access to view all the records automatically.

If this isn't the situation, please explain more and I can try and help.

Hope this helps. Please accept if answers your question or Like if helps in any way.
Thanks,
Drew
benji-7
Frequent Visitor

This is almost solved. In my other post I found the solution using append and append to access rights to handle the permissions for the child tables.

 

So for every row that I create in the parent table I create the two groups with one read, the other append to rights on that created row. That's how I then can assign users to the different groups. For me that's not a problem as I have sysadmin role and can create new groups in the teams table and then use relate, unrelate in the app to assign the users to the groups.

 

I want to accomplish that some of the other users are able to create rows in the parent table as well. But that would mean, that I have to give them permission to create access teams in the team table, right? I don't now if this is could be a security issue.

 

Is there any other solution?

 

 

dpoggemann
Super User
Super User

Sorry @benji-7 ,

 

Sorry, not sure exactly what you are doing here exactly.   Hopefully the following makes sense.

 

Parent Table

  1. Use standard roles and assign them to users.  You could have one role where the user can create records and one where they can not on the parent table and assign these roles to the users.
  2. On the child records, if you have two distinct groups of users (i.e. teams) that need access to different records and be either able to update or view then you can do the following:
    1. Assign the team that is able to update the rows to the owner of the record.  The role assigned to the team would have Write on the child table records they are assigned as the owner.  No sharing required here.
    2. All other users, provide read to the child tables and they will be able to view the records without any sharing required.

I am happy to jump on a call sometime to walk through this in more detail if you need.  Maybe I am missing the situation here but I think we can accomplish your needs with the above.

 

Hope this helps. Please accept if answers your question or Like if helps in any way.
Thanks,
Drew
benji-7
Frequent Visitor

Sorry for the confusion... maybe I over-complicate it 😅.

 

Maybe I make an example:

 

I want to realize a trip planner for our NGO in Germany who is sending different groups to different countries.

One or two of each group are the trip leaders, the others are supporting and are trip participants.

 

Let's say we send a group to Argentina and another group to Mexico.

 

I created the following tables:

Parent: General Trip Details

Child 1: Budget List

Child 2: Trip locations

 

These are the teams:

  1. Team Admin (overseer, not the trip leader):
    • Creates the trips to Argentina and Mexico
    • Has full access to all records
    • Is assigning the trips to the users 
  2. Team Argentina Write (trip leaders)
    • Can read Argentina details and read, write, change, delete budget and locations for Argentina (can't view or change Mexico trip)
  3. Team Argentina Read (trip participants)
    • Can only read the Argentina details, budget and locations. (can't view or change Mexico trip)
  4. Team Mexico Write 
  5. Team Mexico Read

So far I managed that with creating two records in the teams table for each row that is created in the "General trip Details"parent table and assigned the users to the teams.

 

Teams.png

The only problem I now still have, is that I can't easily

  1. let users create new records in the teams table, because of security concerns and
  2. was not able to find an easy way to assign the teams in powerapps (canvas) to the records in the "General trip detail" parent table. It's easy in a model driven app, but not in a canvas app. 

Your suggestion in my view would work if I really only have two teams that can access all the trips.

Thank you so much for looking into that. I really appreciate that! 

dpoggemann
Super User
Super User

Hi @benji-7 ,

 

Thank you for the example.  Looking at your situation I would probably do the following type of setup in Dataverse. This is just an option you might want to review.

 

Tables

General Trip Details

Trip Members

Budget List

Trip Locations

 

The new table I am suggesting would have a lookup column to the User table and would also have a "Role" defined for Leader or Member.

 

Access Teams

https://docs.microsoft.com/en-us/power-platform/admin/create-team-template-add-entity-form

https://docs.microsoft.com/en-us/power-apps/user/access-team

  1. Setup six Access Team Templates with two defined for the General Trip Details, two for the Budget List, and two for the Trip Locations. 
  2. Two templates for each entity so you can control the user access to the records if they are assigned to the appropriate Access Team for that record with one being Read and the other containing Read, Write

 

Power Automate Flow (Assign Access Team Membership)

When members are added or removed from the Trip Members table, run a Power Automate flow that will assign or remove them from the specific Access Teams for the 3 tables.  I think you would be able to utilize the bound actions for AddMemberRecordTeam and RemoveMemberRecordTeam in Power Automate but I have not looked at this in detail...

 

Overall the above approach would not require any maintenance as you add more trips etc. as the dynamic security for the members will be controlled at the record level based on the access teams they are assigned.

 

 

Hope this helps. Please accept if answers your question or Like if helps in any way.
Thanks,
Drew

Helpful resources

Announcements
Power Platform Call June 2022 768x460.png

Power Platform Community Call

Join us for the next call on August 17, 2022 at 8am PDT.

Power Platform Conf 2022 768x460.jpg

Join us for Microsoft Power Platform Conference

The first Microsoft-sponsored Power Platform Conference is coming in September. 100+ speakers, 150+ sessions, and what's new and next for Power Platform.

365 EduCon 768x460.png

Microsoft 365 EduCon

Join us for two optional days of workshops and a 3-day conference, you can choose from over 130 sessions in multiple tracks and 25 workshops.

Users online (1,560)