Prevent people from accessing SharePoint list that the PowerApp is connected to

[AnnaBrodnicki]

I'm building a marketing studio time request app that doesn't contain personal information but business sensitive information from the point of view that we don't want people to see other people's submissions due to the inernal politics that might result from it.

I am setting up the powerapp so that staff can submit their time requests and then can go back into the app and view/edit their own submissions only using a formula based on user.  The data source is a SharePoint list.  I understand that in order to add/edit from the PowerApp they need to have the relevant permissions for list in SharePoint.  

So the PowerApp will act as the front end for the submissions and the SharePoint list will act as the back end for the team processing the submissions.

I don't want people in the organisation to be able to access the SharePoint list and view other people's submissions/list items or have the ability to edit other people's submissions/list items.

I could hide the SharePoint list as much as I can by not having it on navigations etc and even create a default view that contains bare minimum info in case someone does navigate there but I feel it's still open to being discovered and information viewed.  This is a worry for any future apps that I might create that contain personal data or business sensitive information.

Does anyone have any suggestions about the best way to control this and prevent people from accessing the Sharepoint list that the PowerApp is connected to? 

Thanks,

Anna

[EP3]

Hi, Thanks for the response, but I believe I have worked it out and it's really simple:

I build an app in a production environment using dataverse tables within that environment, I share the app to people who don't have access to the environment, they can access the app, and any data it pulls from the tables, but can never open the dataverse tables or use them in their own apps because they can't access the environment.  Is this how it works?

[kky1]

THANK YOU @Adam_116

Almost 4 years later and your response is still helping people!

@kky1 

[RCCadogan]

This is amazing. Just what I was after! Thank you 🙂

[stevegeall]

Just a note, if anyone creates a PowerApp and adds a data source to SharePoint and knows the site name / list name etc, then they will STILL be able to read the list by adding a gallery etc. Only downside.

I now use a Power Automate flow to trigger when an item is created or modified (with a condition based on a column like UpdatePermission = "yes") that removes all permission on that item, then adds custom permission based on another column like PermissionCommaSeparated which may have multiple people's UPN/email listed and use that to grant new permission on the item. This way permission can be dynamically updated for items from PowerApps.

[RCCadogan]

Does that also mean someone can add the sharepoint list via the url in a power bi model??

[stevegeall]

not sure, give a whirl and see - would be interested to know myself

[dza1]

How would I set special permission for the following two groups?

• Group A. – They need to be able to access the entire list and have the ability to add/change fields that are already in the list. However, I don’t want them to have the ability to create new columns and move things around.

• Group B. – permission to edit items in the list exclusively via the app but no permission to access the list from SharePoint. This is very important as we don’t want other users to see other people’s entries.

I believe what has been suggested by @Adam_116 & @stevegeall can be applied to Group B, But I'm not sure how I would set unique permissions for Group A. 

Any help would highly be appreciated. 

[AdrianBlanariu]

I would like to do the same thing but I don't work with lists. I have a folder with 3 excels which are connected to my App. Is it possible to do the same changes or do I need to convert everything to a list an remake the connections in my App ?

[rrobles88]

Just want to give you a huge thanks for sharing your knowledge because this still works to this day. Hopefully MS doesn't change something that messes this up and if they do that they create a standard out of the box config to enable something like this instead of end users figuring out workarounds with big risk! 

[simmyjer]

Does this still work? I imported my app in a different environment and followed the instructions. Now it gives me "Error when trying to retrieve data from the network"