User with Read access to table can add and edit docuements

[donalmc]

I know that Dataverse and SharePoint security do not sync, but surely the below cannot be correct?

A user only has read access to a table that is enabled for documents.

This user is able to add and edit documents to records in the table.

I'm guessing that nothing can be done about this?

[FLMike]

Hi @donalmc 

If its a Dataverse table and you say they can read-write. Are they read-writing rows or specifically the documents?

Trust me if the security is correct for the user, they won't be updating/creating with read-only.

Verify all the security groups they are in (both AD and Office365 types). Verify what roles they have.

Verify that any of the roles they were given weren't accidentally given read/write/delete whatever to that table.

Verify what Teams they are in, verify the BU, verify Team and BU privileges etc

You'll find its in there.

If I have helped you, I would really appreciate if you please Mark my answer as Resolved/Answered, and give it a thumbs up, so it can help others

Cheers

Thank You
Michael Gernaey MCT | MCSE | MCP | Self-Contractor| Ex-Microsoft
https://gernaeysoftware.com
LinkedIn: https://www.linkedin.com/in/michaelgernaey

[donalmc]

User has Basic User and a role that gives them only Read access to a table that is enabled for documents.

User can:

• Add documents
• Edit documents added by others

[gulshankhurana]

Hi @donalmc 

In my opinion, you need to look at the security permissions in SharePoint if you want the controlled/restricted access to documents. 

Kind regards 

Gulshan

Please give it a thumbs up 👍🏻 if you appreciate my efforts.

If my answer helped you resolve your issue then please also mark it as a solution ✅  so that it helps others experiencing the same problem.

[Fubar]

As per Gulshan's post, the out of the box SharePoint integration is essentially a viewport into the SharePoint location, what a user can do within that viewport is as per their SharePoint permissions (similar to if the user navigated to that location directly in SharePoint).

[AllanDeCastro]

Hello,

When you enable document management for a table in Dataverse, documents related to the records are stored in SharePoint. Even if a user has only read access to the table in Dataverse, they might still be able to add or edit documents in SharePoint if their SharePoint permissions allow them to do so.

[FLMike]

@donalmc 

This (the other answers) is why I wanted you to verify their roles. As always fine print of security.

As also mentioned, if they have access to the SharePoint Document library another way, they can do it there as well.

If I have helped you, I would really appreciate if you please Mark my answer as Resolved/Answered, and give it a thumbs up, so it can help others

Cheers

Thank You
Michael Gernaey MCT | MCSE | MCP | Self-Contractor| Ex-Microsoft
https://gernaeysoftware.com
LinkedIn: https://www.linkedin.com/in/michaelgernaey

[donalmc]

Folks - thanks for the replies.

I fully understand that Dataverse and SharePoint security do not sync in any way.

I just did not expect that a user with Read access to a record could edit associated Documents in Dataverse (even if it is just a window into SharePoint).

In my actual installation, Documents are delivered via a form tab and sub-grid, so I will hide this by default and show it to users with Edit privileges on the record,