Show records by the current user role (Model Driven App)

[Tea_Programmer]

Hi,

I'm new in Power Platform more specific in Power Apps (Tables and Model Driven Apps).

I would like to know if my idea is executable, if so how can I possible achieve it.
To give you more context, I'll describe what I have at the moment.

1. 
   

   Users	Business unit
   User1	org123
   User2	org123
   UserManager1	org123
   UserManager2	org123

2. 
   Table (ProjectUsersTable) with Name and Country columns
3. 
   I've a security role that consent permission to Create, Read, Write and Delete to 'ProjectUsersTable' (SecurityRolePerms.png)

I would like to know if the following image (Example.png) it's possible to execute and how I can possible do it.

Thank you in advance,
Ruben

[gulshankhurana]

Hi Ruben

I believe the users will be assigned in each BU as per their territory and they will only be creating records for customers in their territory/country only?

1. You'd first create 2 child Business Units - France and Spain.

2. You'd then create 2 custom security roles - User and Manager. I'd recommend finding the nearest possible existing OOTB security roles and then creating a copy of these to then tweak the copied roles to your needs.

3. The ProjectUser table will be found under 'Custom Table' tab in each security role. For user role, you'd give 'User' level permissions to Create, Read, Write, etc. For Manager role, you'd use 'Parent/Child Business Unit' level permissions.

If my reply addressed your concern then please give it a thumbs up and accept it as a solution.

Kind regards

Gulshan

[MarioRing]

No, it won't work the way you want. Permission to the record depends on:

* Current user privileges (security roles)

* Owner of the record we want to get access to.

* Relation between current user's and record owner's Business Units

 In your example you are using some additional field on your records "Country". Unfortunately, the Dataverse will ignore this field in terms of data access.

You want for users to create a records which will be visible only for them and the members/managers of the country they assign for the record. To solve this problem you have to apply the "Access Teams" feature. See the documentation here.

[Tea_Programmer]

Hi Gulshan,

Thank your for your response. In my case any user can create records for every country and not necessarily for his own country. With this new information, would you keep your solution or should I change something ?

Thank you.

[Tea_Programmer]

Hi Mario,

In my case, an user can create a record for any country and if I create a "Access Team" like for France is it possible to assign an "Access Team" for each record automatically checking the Country column?
Currently I can not associate a user to a specific country team because any user can create a record for any country.

Thank you,
Ruben

[MarioRing · Accepted solution]

Creating an Access team, from the UX perspective, is adding a subgrid (list of related records) to the form of table you want to distribute. This subgrid collects the users or teams who can get access (to view, edit or delete) to the given record (in addition to the user who is the owner of the record). It's just like "This is the list of users who can also get access to this record in addition to the owner of the record".

Access team is a team automatically generated for every record of the given type. Every record has its own, separate group of users who can view, edit, or delete this specific record + the owner of this record.

In your scenario, the user after the creation of the record needs to assign specific users or teams to the record by adding them to the record's access team. For example: I am a user from Germany but I created the record for Spain. I have to add the Spanish team to access the team of the record I just created. After that, I can get access to the record, because I am still the owner, and additionally all listed users in this record's access team have also access to the record.

If you want to do the process related only to the specific field on your form (I mean Country) you have to create a Power Automate Flow, which will be triggered after the creation of the record or changing its "Country" value. The Flow should remove all previously existing members of the Access team and add them to the specific Country Team dedicated to the given country.

[LinnZawWin]

@Tea_Programmer 

Please read more about the access team template and here is a sample cloud flow on how to add users to the access team. (as @MarioRing suggested)

https://www.mibar.net/blog/how-to-add-users-to-an-access-team-with-power-automate/

In addition to the solution above, you also need to consider handling the change of Country Manager. In that case, the new manager should be added to the access teams of the records with that specific Country and the previous Country Manager should be removed from the access teams for those records.

[Tea_Programmer]

Ok!! One more question if you don't mind.
I have an access team, how should I assign the new record to the team? Is there any column or configuration that I need to do in order to assign via Power Automate without using the owner field?

Thank you for your great explanation!

[LinnZawWin]

You need to call the AddUserToRecordTeam action using Perform a bound action from Dataverse connection.

You can refer to the last screenshot in this blog post.

https://www.mibar.net/blog/how-to-add-users-to-an-access-team-with-power-automate/

[Tea_Programmer]

Hi @LinnZawWin @MarioRing  ,

I'm facing an issue regarding Power automate (Perform a bound action). (PowerAutomate Perform a bound.png)

I've already configured the access team to the table and when I create a new item from the Form already displays the access team tab, also it's all together in one solution.
Am I missing some crucial configuration in order to use the "Perform a bound" action ?