Prevent people from connecting an app to a SharePoint list

[scotthanks]

I've created some PowerApps apps for SharePoint lists because I needed to provide custom forms and control what information is provided to and can be changed by users.  Is there any way prevent users from simply creating their own app and connecting it to my list to bypass whatever customizations and restrictions I put in my app?

[Anonymous]

I agree, would like to know this as well.

For example, I have a few cases where the user should see the 'Add new item screen' only (e.g. after clicking a button 'Add Incident') and they never see the list?

[DavesTechTips]

Hi all

I understand this is not ideal, but you can consider customizing the default form in the sharepoint list to be a PowerApp form as well, and just add one control on the Form to tell the user that they shouldn't be here Attached is what they then see when they try and access an item.

You can then also hide all the detail on the view and prevent users from creating customised views.

[pepeday]

This doesn't help as anyone can create a powerapp and connect to the list data, so your solution doesn't actually block access.

[Anonymous]

I agree that there needs to be another way..

If PowerApps Forms are supposed to replace Infopath forms, we need a way to guide people to the 'new item' screen only without them seeing the underlying list at all! For example for submittiong CEPs (Capital Expenditure Proposals), Incidents, etc. For those cases it would not be acceptable for the user to see the list and therefore previously submitted data from others.

Maybe if it's possible to get a URL that links to the 'new item' form directly, and the form is customized to fill the screen, then the experience may be similar to an infopath form. However users could then still close the form and see the list..

sarafankit - Would you have any suggestions?

[sarafankit]

The ability to get a link for New item already exists. Open the New Form in the list and click the "Copy link" option. You can just share that with other users.

Once they submit the form though, it will lead them to the list. So, if you are worried about users seeing entries made by other, you should use existing SharePoint capabilities to filter that out as it is done today with InfoPath.

[scotthanks]

I'm able to block users from accessing the list while still being able to read and create/update/delete items using my app.  Even if they were to somehow get the list URL, they'll get "access denied".  I just can't prevent them from creating their own app and interacting with the data in an undesirable way. 

[Anonymous]

Hi scotthanks 

Sorry for taking your original question/post off track. Would you mind sharing how you managed to block users from accessing the list please?

I believe in order to prevent users from creating their own form they need to have 'contribute' permission at most - anything more than that e.g. 'edit' will allow them to create a powerapps form.

[pepeday]

Blocking the creation of a Powerapp and connecting to a list does not seem possible, even with read only permissions.

What @scotthanks is talking about is blocking access to the list itself.

[scotthanks]

Hi @Anonymous,

No worries.  Here's how I was able to block browser access to the site and lists while still allowing users to read/add/edit/delete list items through my app.  First, I created custom permission levels described below.

• For lists where users need read/write access through the app, I created a permission level with these permissions only:  Add Items, Edit Items, Delete Items, View Items, View Versions, Delete Versions, View Pages, Browse User Information, and Open.
• For lists where users need read-only access, the permission level has View Items, View Pages, Browse User Information, and Open.
• Since the above permissions don't hide the lists from the Site Contents page, I wanted to prevent users from accessing the site and browsing around.  To do this I created a permission level with only these permissions:  View Pages, Browse User Information, Use Remote Interfaces, and Open.  I granted users this permission level to the site.  If you do this but still need users to be able to access some pages in the site, you'll likely need to grant them access to some things like the Style Library and master pages and page layouts.

IMPORTANT:  For this to work, you must also activate the "Limited-access user permission lockdown mode" site collection feature.  I might also be necessary to activate the publishing feature.  I can't remember for sure.  The site where I use this does have the publishing feature turned on.

I hope this helps.