Sharing Apps - how to ensure that people only see the data they are allowed to see?

[YvoValcon]

Hi all,

How can I ensure that an app that is created in an organization, for example by someone from the department Finance and is shared with someone from Operations, does not show data which people from Operations are not allowed to see?

Is this possible with Dataverse? If so, how?

Is this possible without using Dataverse? If so, how? <-- this would be ideal as this is a free option.

Thanks in advance!

[HSheild · Accepted solution]

Hi @YvoValcon 

The best approach is to use Dataverse as it includes a security model (security roles, business units) that you can configure to meet your security needs.  See Security concepts in Microsoft Dataverse - Power Platform | Microsoft Learn

Without Dataverse, making the data secure becomes very difficult and you'll most likely end up with separate data sources (e.g. if you are using SharePoint as a data source then you will end up with separate lists) and this can be a nightmare to manage.

My advice is to invest in the licenses required for Dataverse, it will save you a whole bunch of time and headache in the long run!  I've seen scenarios where people try and shortcut this with the 'free' approach but it ends up costing way more in maintenance and support.

[YvoValcon]

Hi @HSheild ,

Thank you for the reply. I am afraid that supplying the whole organisation with premium licences is not an option.. but I agree with you that Dataverse does fix a lot of potential problems. Have to get creative I guess!

[leemager]

Adding my 2 cents as this is a really common issue and while Dataverse is the GOAT for refined permission control, you can really do a lot with Sharepoint lists on that front. They may be somewhat painful to handle permissions but if the cost of premium for Dataverse is a non-starter, it's worth trying.

Sharepoint lists benefit from row (item) level permissions so you can enable view / edit / none permissions for a single list at the row level, this can be done via Power Automate (grant access to an item or folder) in bulk or as needed when an item is added or updated, you just need a column in your list containing the email/s of those you want to grant view/edit access to. No column security which may be a deal breaker, but if it's valuable enough and your org isn't drowning in the cash needed for bulk premium licenses, it's worth separating out tables imo.