Dataverse permissions and Powerapps

[Oskarkuus]

Hi

I have setup some applications using dataverse as datasource.

It is time to start launching these apps to my organisation and i need to get a better grasp of the permissions users need and specially how i should grant them permissions.

At the same time i am bringing in another person into my one-man-team maintaining and building solutions.

1. An application (powerapp canvas) that use a custom table and one already existing table from dataverse as datasource.

What role/permission should users be granted to be able to read and write All rows in these tables so they can see the data and add new data?

2. How to keep the users being shared access to these tables from also getting access to the table itself and be able to add columns, access data without going through the app (powerapps canvas)?

3. How to grant my new team-member access to the actuall tables so he can work with the tables, adding columns if needed, deleting columns, adding views etc.

4. How to micromanage the access of my team-member maybe not granting him full access to creating adding new columns in some tables but being able to create new views?

[dpoggemann]

Hi @Oskarkuus 

1. It is best practice to create custom roles (you can copy from a standard role that exists like Basic User) and then set the security to what you need for the different groups of users.  Security roles can be setup for access at each table with different levels of security, please see the following article (https://docs.microsoft.com/en-us/power-platform/admin/wp-security-cds) for details.  
2. The user would need a system customizer or system administrator role to apply customizations to the tables etc. in the environment, see here:  https://docs.microsoft.com/en-us/power-apps/maker/model-driven-apps/privileges-required-customizatio... 
3. Same answer as #2 but you would give the member one of the roles.
4. This is not possible as far as I know unless you went down an approach to build a solution in another environment and then promote it to the environment that this user has access to as a managed solution.  You could then be able to control that they can not modify your solution you built but only add / modify on top of this.

[Oskarkuus]

Thank you for your response.

I have a few more questions...

Is there some documentation on what each row/tickbox actually controls.

I made a copy of the basic user role.

Just understanding what each box actually controles is my first struggle.

I am working on how to fix the language in my enviroment so i can have english instead of swedish.....

Since i only use Canvas apps together with custom and standard dataverse tables.

Would it be enough to just copy the basic user role and change access in the last tab

[dpoggemann]

Hi @Oskarkuus ,

I would say "primarily" yes, since those are your custom tables and you can provide appropriate access to them.  Most of the other tabs will not be of consequence to your setup in the Canvas app.

I don't know if specific documentation on each row in the security.  I usually have to Google to find the specific ones if I have questions, sorry.