CDM: Needs to limit access

[mr-dang]

CDM entities are downloadable by users in the domain. Is there a way to share an entity with other users for app usage, but lock down back-end access? This is a major concern.

[Perumal]

Rightnow, its not possible.

Microsoft may provide this during the GA. Check the below documentation

https://powerapps.microsoft.com/en-us/blog/cdm-preview-available-for-powerapps/

<snip>

Just like any other app built on the PowerApps platform, you can share your CDM-based apps with other users or security groups within your organization. In this preview, permissions to the database are automatically managed as you share the app. However, future iterations will introduce additional options to help secure data based on entities, fields, and records. Data authorization is done on the server tier, so only authorized users will be able to access CDM data based on the apps that you have shared with them.

<snip end>

[ChrisParker]

CDM is not useful until it has row-level access.

[mr-dang]

Please please please provide us ways to limit access to prevent users from downloading the entire entity. This is a big security flaw. Users should only be able to write to it without seeing the backend.

Before environments, my users lost access. But now with Environments, they can see everything again.

*High priority*

[mr-dang]

WAIT I think I figured it out. 

1. Open PA in browser
2. Click the Gear button in the top right
3. Click Admin Center
4. Select an Environment
5. Select Admin/Maker
6. Remove other users

Can this be unshared by default?

[Darshan]

The maker role provides rights to create/edit apps in an environment and is not to control user access to data.

We are currently in the process of rolling out new features with CDM: https://powerapps.microsoft.com/en-us/blog/new-common-data-service-features-coming-soon/ Better security management for accessing data is part of that. You will get it soon.

[mr-dang]

Ok, I was wrong. If you remove Maker rights, then the environment and the apps are no longer visible to the users.

I look forward to the new features of CDM. Will there be an announcement when things are formally done?

[mr-dang]

I was able to see options for Roles and Permissions. They are not usable yet so I assume that updates are still rolling out. Is there an ETA when those will be ready? Within days or by the end of the week?

[Frank]

Roles and permissions won't be enabled on preview legacy environments, only on new environments. Ones you create today should be good to go, give it a try.

More details about environments are in James' blog https://powerapps.microsoft.com/en-us/blog/powerapps-environments/ 

[mr-dang]

After creating a new environment, I still get the message "Something went wrong. Please try again later."