Help with row level security model

[absoluteBeginer]

I am looking for the best way to implement security/data access on my Dataverse table. My scenario is as follows.

Table: Run (Columns : Job No, Run No, Name, Raw data, Last Correction

RTOC user type:

                read       Job No, Run No, Name, Raw data, Last Correction

                write      Job No, Run No, Name, Last Correction

 *for certain records*

MWD User type :

                read       Job No, Run No, Name, Raw data, Last Correction

                write     Col Raw data

 *for certain records*

Field User type:

                read       Job No, Run No, Name, Raw data, Last Correction

RTOC users can only access certain data from the table. More than 1 RTOC user can access the same record, but they need to be in the same group.  RTOC user creates record - assigns access (according to user type) to that record to certain MWD and Field users. At the same time other RTOC users that are in the same group as this RTOC user have the same level of access as that user.  A MWD or Field user can only access 1 Run record at a time. When the job is finished, the access is removed from the user.

RTOC1 and RTOC2 can only access records 1, 2 and 3.

MWD1 can only access record 1

Field 1 can only access record 1

MWD2 can only access record 3

RTOC3 can only access record 4.

MWD3 can only access record 4

So I need to dynamically assign different access to certain records to different users.

I was wondering whether you could model this scenario just using business units - or if there is a better way.

Thanks

[EricRegnier]

Hey @absoluteBeginer, If you setup the Access Team following the steps in the link you sent previously then you're also there 🙂 You need to modify the run form and add the team subgrid there to allow the creator to add the user to have access. You can following these steps: https://learn.microsoft.com/previous-versions/dynamicscrm-2016/admins-customizers-dynamics-365/mt826... 
And to add/remove users: https://learn.microsoft.com/power-apps/user/access-team 
Hope this helps!

[absoluteBeginer]

Hi,

Sorry I am probably being incredibly dumb here. I have created an access template for the Run entity and I have a canvas app that I use to create and monitor runs. In this app, I have a screen for creating a new run which has a custom edit form (just created in the app) to create the run.

My understanding is that by creating the access template for the Run entity, when a Run record is created, the system automatically creates an access team for that record and I should be able to define users to be added to this access team. The link I mentioned defines adding this as a sub grid on the main form on the entity - but I don't use this - I use a custom edit form. So my question was how I could add the users to the access team for that Run record. Can I add a sub grid to my edit Run form through editing the app? Is there a field on the Run record that I can update?

I think I'm just missing that link between my custom canvas app and adding users to the access team that has been set up.

Thanks

[EricRegnier]

Ok, not sure why but I assumed your had a model-driven app not the canvas app. It's all out-of-the-box with model-driven. Did you wanna give that a try? Might be worth instead of re-inventing the wheel... Otherwise, you have to build that functionality within the canvas app which might not be too complicated if youre comfortable with canvas apps. Here's a summary how:
1) Add the Users and Teams tables to your app:

2) Have a gallery that lists all the users in the new Access Team created. The Items expression of the Gallery should look somehting like this:

LookUp(Teams, DisplayName = "My Access Team").Users

2) Customize the gallery items to have a "Delete" button and on select Unrelate the team from the user. Example of expression:

Unrelate(Gallery1.Selected.'Teams (teammembership_association)', LookUp(Teams, DisplayName = "My Access Team")

3) Have an email textbox and "Add" button and on select, if the textbox contains data relate the user. Example of expression:

Relate(LookUp(Teams, DisplayName = "My Access Team").Users, LookUp(Users, Email = TextInput1.Text))

Note: haven't fully tested the expressions but it's just to give you the idea and a quick start. There are also perf improvements like saving the Accesss Team in a variable.

Hope this helps!

[absoluteBeginer]

Hi,

thanks for this @Eric . One piece I am missing still.

When I create a Run - an access team is automatically created (since I create an Access Team Template)? What is the name of this team? How do I reference this team to add users to it?

Thanks

[EricRegnier · Accepted solution]

Hi @absoluteBeginer, yes with Access Teams Templates there are automatically created, but they are created when the first user is added to the team and unfortunately this is only supported with model-driven apps and wouldn't work in your scenario (ie canvas apps).
With user-created access team like in my previous example, all users within that team will have access to all records you grant it access to unless you create seperate teams and share the Run record with that team. This can be automated with Power Automate where you can auto-create the access teams and share when the Run is created. Effectively, re-produce the logic of Access Team Templates...
Hope this clarifies. I can appreciate that security modelling is an advance topic and there's lots of capabilities to solve different needs. Try to keep it simple at first I would say.

[absoluteBeginer]

Thank you for your assistance. Just one final question 🙂 If I have external users (external to my company. Can I add those people to the access team? The idea is that external users should have their own power apps license and they would get approval to access our tenant. I'm not sure how these users fit into the access teams idea.

Thanks

[absoluteBeginer]

Could I call a flow when a new Run record is created in my Canvas app that

• Adds a new user created access team (Add a new row to Team table)

• shares the record I've just created in the app to the new access team created above
• Add users to the access team (these users already have security roles associated to them which determines their type of access)

How would I do the second and third actions in the flow?

Would this mean that the only the users defined in the user created access team can access the given record.

Thanks

Thanks

[EricRegnier]

Hi @absoluteBeginer, apologies for late reply. Not sure if you got this resolved. Yes, you can call a flow which adds a member to a team. The action and table name to use is the following:

For the "Row ID" use the ID of the newly created team, and the "Relates with" is the User GUID.
Hope this helps!