Sharepoint Permissions - No Edit & No Delete

[fbarini]

Hello! I'm lauching my first company app this week and I stumbled across a problem.

I configured my permission levels, in order that Users can't edit nor delete rows in a list. However, when I try to create a record in my app, I'm receiving an error from my Patch function, which tells me that "my DB Table is only for Reading or it doesn't have a primary key".

I found out that this error doesn't occur when I enable editing, on the users permission levels, but this would definitely not work, since this list will be used to gather KPIs, and having people enabled to edit it might compromise it...

To give you guys some context, this app is supposed to open a hiring request, which goes trough 3 level of approval (if all approves we open a new hiring process) and a final confirmation ("Hired"). So the rows are dynamic before each of them reach a "Approval Status" = "Hired"

Thanks in advance

[BCLS776 · Accepted solution]

Unfortunately, if your app needs the ability to add/edit records in your SharePoint list, then the list must be shared with edit-level access with the users of the app. One way to help with this is to build in some Power Automate flow(s) triggered by changes to the list itself (not triggered by PowerApps) to help handle the records. For example, create a copy of records to another list automatically as they are created or when the status reaches "Hired". Or, keep a running log of each change to the list, again in a separate list that is hidden from view. Flows that are not triggered by the PowerApp can be run in the context of the flow's maker, which means you can give access to that second list to the flow maker, not the app users.

Hope that helps,

Bryan

[fbarini]

Thanks for your reply.

Users would be only able to Add.

Admins would be able to Add/Edit.

For Admins, I set up a custom permission level and it's working fine. As for Users, I'm having trouble to make them able to only add items. If I try to add via SP list, it works. But via PowerApps (Patch) it doesn't.

Is it because the Patch(Defaults) creates a row and THEN edits it? If yes, do you know any workaround to create the row directly with the values input via App?

[BCLS776]

For SharePoint lists, adding and editing are the same level of access - if your regular Users need to add records to the list, then the same permission level gives them the ability to edit. You can hide the list a bit to prevent inadvertent edits, but a determined user will be able to find a way to the list and change it if they want.

If you need something with a more robust row-level security scheme, then consider using Dataverse or SQL. Lists are easy to use, but they don't offer that kind of security.

[v-xiaochen-msft]

Hi @fbarini ,

I think there's a workaround.

In order to achieve this goal, you need two lists (List A and List B). You also need to create an automated flow.

The user can edit the A list but cannot edit the B list. User submits data to list A. When listA has a new item, the automated flow is triggered. The flow is used to copy the data in listA to listb. 

In listb, the owner is you, not other users, and they do not have permission to modify the list.

Best Regards,

Wearsky