Is it possible to restrict access to CDS Data Source in a different environment

[LeeHarris]

Hi All,

I was wondering if it is possible to restrict access to another Environment's CDS if the app being developed is in a different Environment?

For example

User 1 is an Admin and has full rights to create Apps in the Production Environment.

User 2 is an end user and has the Environment Maker role in the Sandbox Environment.

User 2 has Read/Create/Update/Delete access to entities in both Sandbox Environment and Production Environment.

User 2 creates an app in Sandbox Environment and defines a connection to CDS in Production Environment.

User 2 can now affect records in Production Environment from their app.

Is it possible for the above to happen, and if so is there a way that it can be prevented? Ideally, User 2 would create their app in the Sandbox Environment against the sandbox CDS. When they are happy with it, they submit it to User 1 (Admin) for deployment to the Production Environment. I know that there is a "Current Environment" option when defining the CDS data source within PowerApps but the option for choosing any environment is still available. To be clear I don't want to restrict the Users access to the entities in Production, just prevent them creating data source connections to it from another Environment.

[v-xida-msft · Accepted solution]

Hi @LeeHarris ,

Do you want to prevent the users from creating a connection to CDS in Production environment within their Sandbox Environment?

Which Security role does the user have to your Production environment?

If the users have proper security role of your Production environment, and have appropriate permission to access the CDS in your Production environment, he would be able to create a connection to the CDS in your Production environment from any other different environments under same tenant.

Currently, within PowerApps, there is no way to prevent the users who has enough permission to the CDS in your Production Environment from creating a connection to CDS in Production environment within their Sandbox Environment (Different environment).

Best regards,

[LeeHarris]

Hi @v-xida-msft 

"Currently, within PowerApps, there is no way to prevent the users who has enough permission to the CDS in your Production Environment from creating a connection to CDS in Production environment within their Sandbox Environment (Different environment)."

This was the confirmation I needed, thank you. I will raise it on the ideas board as it would be useful to be able to allow people access to develop their own applications within a sandbox environment that matches production without running the risk of them affecting any live data.