Share Dataverse row with user or group in Powerapps Canvas

[benji-7]

Hallo,  I am working on an Powerapp where I create a row in a Dataverse table. For each row I create two groups in the "Team" table. Now the goal is that I share the created row with those two groups, one with read, the other with write permission. Is there a way to accomplish that with Powerapps using a Canvas App? 

The only thing I have read so far, was to use a flow with the  "perform unbound action".

Is there any other way to solve that?

Thank you for any help

[dpoggemann]

Hi @benji-7 ,

Can you explain more the "For each row I create two groups in the "Team" table?  Do you have two teams overall and for another table you want to be able to have one group with read permissions to all the records and another group have write permissions?  Is this different per record or consistent for all records that you are creating?

If this is consistent for all records I would do the following:

1. Set the Owner of the record being created to the Team that has the Write capabilities.  You can then setup the role for this table that they can then modify their owned records and it will cover this
2. The same role can be used for the users you want to be able to have "View" the records and you wouldn't need to share with the team at all, just the role assignment for Read being at Organization or Business Unit level and the users in this team would have access to view all the records automatically.

If this isn't the situation, please explain more and I can try and help.

[benji-7]

This is almost solved. In my other post I found the solution using append and append to access rights to handle the permissions for the child tables.

So for every row that I create in the parent table I create the two groups with one read, the other append to rights on that created row. That's how I then can assign users to the different groups. For me that's not a problem as I have sysadmin role and can create new groups in the teams table and then use relate, unrelate in the app to assign the users to the groups.

I want to accomplish that some of the other users are able to create rows in the parent table as well. But that would mean, that I have to give them permission to create access teams in the team table, right? I don't now if this is could be a security issue.

Is there any other solution?

[dpoggemann]

Sorry @benji-7 ,

Sorry, not sure exactly what you are doing here exactly.   Hopefully the following makes sense.

Parent Table

1. Use standard roles and assign them to users.  You could have one role where the user can create records and one where they can not on the parent table and assign these roles to the users.
2. On the child records, if you have two distinct groups of users (i.e. teams) that need access to different records and be either able to update or view then you can do the following:
   1. Assign the team that is able to update the rows to the owner of the record.  The role assigned to the team would have Write on the child table records they are assigned as the owner.  No sharing required here.
   2. All other users, provide read to the child tables and they will be able to view the records without any sharing required.

I am happy to jump on a call sometime to walk through this in more detail if you need.  Maybe I am missing the situation here but I think we can accomplish your needs with the above.

[benji-7]

Sorry for the confusion... maybe I over-complicate it 😅.

Maybe I make an example:

I want to realize a trip planner for our NGO in Germany who is sending different groups to different countries.

One or two of each group are the trip leaders, the others are supporting and are trip participants.

Let's say we send a group to Argentina and another group to Mexico.

I created the following tables:

Parent: General Trip Details

Child 1: Budget List

Child 2: Trip locations

These are the teams:

1. Team Admin (overseer, not the trip leader):
   • Creates the trips to Argentina and Mexico
   • Has full access to all records
   • Is assigning the trips to the users 
2. Team Argentina Write (trip leaders)
   • Can read Argentina details and read, write, change, delete budget and locations for Argentina (can't view or change Mexico trip)
3. Team Argentina Read (trip participants)
• Can only read the Argentina details, budget and locations. (can't view or change Mexico trip)
4. Team Mexico Write 
5. Team Mexico Read

So far I managed that with creating two records in the teams table for each row that is created in the "General trip Details"parent table and assigned the users to the teams.

The only problem I now still have, is that I can't easily

1. let users create new records in the teams table, because of security concerns and
2. was not able to find an easy way to assign the teams in powerapps (canvas) to the records in the "General trip detail" parent table. It's easy in a model driven app, but not in a canvas app. 

Your suggestion in my view would work if I really only have two teams that can access all the trips.

Thank you so much for looking into that. I really appreciate that! 

[dpoggemann · Accepted solution]

Hi @benji-7 ,

Thank you for the example.  Looking at your situation I would probably do the following type of setup in Dataverse. This is just an option you might want to review.

Tables

General Trip Details

Trip Members

Budget List

Trip Locations

The new table I am suggesting would have a lookup column to the User table and would also have a "Role" defined for Leader or Member.

Access Teams

https://docs.microsoft.com/en-us/power-platform/admin/create-team-template-add-entity-form

https://docs.microsoft.com/en-us/power-apps/user/access-team) 

1. Setup six Access Team Templates with two defined for the General Trip Details, two for the Budget List, and two for the Trip Locations. 
2. Two templates for each entity so you can control the user access to the records if they are assigned to the appropriate Access Team for that record with one being Read and the other containing Read, Write

Power Automate Flow (Assign Access Team Membership)

When members are added or removed from the Trip Members table, run a Power Automate flow that will assign or remove them from the specific Access Teams for the 3 tables.  I think you would be able to utilize the bound actions for AddMemberRecordTeam and RemoveMemberRecordTeam in Power Automate but I have not looked at this in detail...

Overall the above approach would not require any maintenance as you add more trips etc. as the dynamic security for the members will be controlled at the record level based on the access teams they are assigned.