You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: powerapps-docs/teams/dataverse-for-teams-table-permissions.md
+40-62Lines changed: 40 additions & 62 deletions
Original file line number
Diff line number
Diff line change
@@ -22,7 +22,7 @@ For example, if you've an app with sensitive customer data, unauthorized access
22
22
23
23
You may think "I'll just obscure access to sensitive data in my app!" However, if the underlying data source is shared with users, they can still get to the data, or build new apps on the data source, giving them access to the restricted records.
24
24
25
-
One of the advantages of building Power Apps in Teams with Dataverse for Teams is that it provides the ability to set the table permissions to your specific business needs that map the security roles in Teams—such as Owners, Members, Guests and App Users.
25
+
One of the advantages of building Power Apps in Teams with Dataverse for Teams is that it provides the ability to set the table permissions to your specific business needs that map the security roles in Teams—such as Owners, Members, Guests, and App Users.
26
26
27
27
For example, if there's a table that the users should only be able to modify for the records that they own, Dataverse for Teams offers a table permission called **Collaborate** that gives users the ability to only edit records that they own. In this article, we'll review the table permissions in Dataverse for Teams, and learn about how you can use them to secure your important business applications.
28
28
@@ -34,9 +34,9 @@ For example, if there's a table that the users should only be able to modify for
34
34
Permission to apps and the data that they use in Teams are based on the following roles in Teams team.
35
35
36
36
-**Owner** - A team member with the owner role. This includes the creator of the team, and anyone who has been given the owner role by another users. Owners get full access to the data used in apps in the team.
37
-
-**Member** - A team member who is not an owner. By default, team members get full access like owners, but you can also change the permission for team members. You might want to restrict members from being able to edit certain tables. For example, in the [Bulletins app for Teams](bulletins.md), if you wanted to have members be able to read the bulletins but not edit them, you could give team members **Reference** permission on the **Bulletins** table.
37
+
-**Member** - A team member who isn't an owner. By default, team members get full access like owners, but you can also change the permission for team members. You might want to restrict members from being able to edit certain tables. For example, in the [Bulletins app for Teams](bulletins.md), if you wanted to have members be able to read the bulletins but not edit them, you could give team members **Reference** permission on the **Bulletins** table.
38
38
-**Guest** - A guest is someone outside of your organization who is added to the team. By default, guests can create records, but not view records created by others.
39
-
-**Colleagues with access**: With Power Apps for Teams, you can share an app with a Azure AD security group whose members need not be part of the Teams team where the app was built. This enables you to add users to the application without having to add them to the specific team, and opens up “Broad Distribution” scenarios. For example, you may want to build an app that is enabled for every accountant in the organization, or even every employee in that organization.
39
+
-**Colleagues with access**: With Power Apps for Teams, you can share an app with Azure AD security group whose members need not be part of the Teams team where the app was built. This enables you to add users to the application without having to add them to the specific team, and opens up “Broad Distribution” scenarios. For example, you may want to build an app that is enabled for every accountant in the organization, or even every employee in that organization.
40
40
41
41
## Understanding table permissions
42
42
@@ -79,71 +79,57 @@ Let’s take a look at how table permissions work in practice. We'll create a ta
79
79
80
80
1. Save and Publish the app. You'll need to select a channel in which the app will be displayed—select **+** next to the desired channel name to select the channel.
81
81
82
-
##Granting permissions to the tables
82
+
### Configure and verify table permissions
83
83
84
-
We are going to set the permissions for the vehicles table for Team members:
84
+
We're going to set the permissions for the vehicles table for Team members:
85
85
86
-
1. In Teams, open the **Power Apps** app. Right mouse click on the Power Apps icon in Teams and select **Pop out app**. This will pop out the app in a new window, so if you navigate somewhere else in Teams you won’t lose your changes.
87
-
88
-
2. Select the **Build** tab.
86
+
1. In Teams, open the **Power Apps** app. Right-click on the Power Apps icon in Teams, and select **Pop out app**. This will pop out the app in a new window, so if you move somewhere else in Teams, you won’t lose your changes.
89
87
90
-
3.Select the team that contains the Vehicle Manager app.
88
+
1.Select the **Build** tab.
91
89
92
-
4. In the **Items created for…** area, select **See all**.
90
+
1. Select the team that contains the Vehicle Manager app.
93
91
94
-
5. Select**Tables**from the solution components bar.
92
+
1. In the**Items created for…**area, select **See all**.
95
93
96
-
6.Select the Vehicle table and then select **Manage permissions**.
94
+
1.Select **Tables** from the solution components bar.
97
95
98
-
7. Select the **Member** node. The initial permission will show Full access. Select the permission **Private** and select **Save.**
| Bulletin | Reference | Users should read all bulletins, but not edit or create bulletins. |
144
130
| Bulletin Bookmark | Private | Users should create their own bulletins, but not view or edit other users’ bookmarks. |
145
131
| Bulletin Category | Reference | Users should read all categories but not edit or create categories. |
146
-
| Bulletin Category Preference | Private | Users should create their own category preferences but should not be able to read or edit other users category preferences. |
132
+
| Bulletin Category Preference | Private | Users should create their own category preferences but shouldn't be able to read or edit other users category preferences. |
147
133
| Bulletin Contact | Reference | Users should read all contact records but not create or edit contacts. |
148
134
| Bulletin FAQ | Reference | Users should read all FAQ records but not create or edit existing FAQ records. |
149
135
| Bulletin FAQ Category | Reference | Users should read all FAQ categories but not create or edit existing FAQ records |
@@ -156,27 +142,19 @@ the table and see the created data.
156
142
157
143
Before assigning permissions, you should plan your security based on the personas of users of your app. Who will administer the app? Who will use the app? How will they use it?
158
144
159
-
For example, the Inspection Power apps template for Teams is designed to address the following personas:
145
+
For example, the Inspection sample app for Teams is designed to address the following personas:
160
146
161
-
- Inspection manager: creates Inspection forms and manages the list of locations or assets.
162
-
163
-
- Inspection reviewer: reviews inspection data and approves inspections.
164
-
165
-
- Inspection User: completes inspections.
147
+
-**Inspection manager** - Creates Inspection forms and manages the list of locations or assets.
148
+
-**Inspection reviewer** - Reviews inspection data and approves inspections.
149
+
-**Inspection User** - Completes the inspections.
166
150
167
151
Once we have the personas defined, relate these personas to the team role to which they should be assigned:
168
152
169
-
- Inspection manager: Since inspection managers will need full access to create inspection forms and other system table records, we will make them owners in the team.
170
-
171
-
- Inspection reviewer: Since inspection reviewers should be able to edit all inspections, but they will not create inspection forms, we will make them team members. This will enable us to give them reference access to the Area Inspection Checklist table (where inspection form data is stored), but full access to Area Inspection table (where inspection records are stored).
172
-
173
-
- Inspection user: Inspection users should only be able to submit new inspections, but not create new inspection forms or see other user’s inspections. So we will not make them members of the team in which the app is installed—we will share the app with them as colleagues, and give them Reference permission to Area Inspection Checklist and Private permission to Area Inspection. This will allow users to view inspection forms and create their own inspection records.
174
-
175
-
## Learn more:
176
-
177
-
For more details on recommended table permissions for the Power App templates for Teams, see the following topics:
153
+
-**Inspection manager** - Since inspection managers will need full access to create inspection forms and other system table records, we'll make them owners in the team.
154
+
-**Inspection reviewer** - Since inspection reviewers should be able to edit all inspections, but they won't create inspection forms, we'll make them team members. This will enable us to give them reference access to the Area **Inspection Checklist** table (where inspection form data is stored), but full access to **Area Inspection** table (where inspection records are stored).
155
+
-**Inspection user** - Inspection users should only be able to submit new inspections, but not create new inspection forms or see other user’s inspections. So we won't make them members of the team in which the app is installed—we'll share the app with them as colleagues, and give them **Reference** permission to **Area Inspection Checklist** and **Private** permission to **Area Inspection**. This will allow users to view inspection forms and create their own inspection records.
178
156
179
-
-[Deploy Profile + as broad distibution app](deploy-profile-plus-broad-distribution.md)
157
+
For more details about the recommended table permissions for the sample apps for Teams, see articles about deploying sample apps broadly, such as [Deploy Profile + as broad distribution app](deploy-profile-plus-broad-distribution.md).
0 commit comments