Skip to content

Commit 27e7f1d

Browse files
Mattp123Mattp123
committed
Merge remote-tracking branch 'origin/main' into matp-3434990
2 parents 7b1c1e2 + f7461d0 commit 27e7f1d

File tree

2 files changed

+242
-19
lines changed

2 files changed

+242
-19
lines changed

‎powerapps-docs/developer/data-platform/security-sharing-assigning.md

Lines changed: 239 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: "Sharing and assigning (Microsoft Dataverse) | Microsoft Docs" # Intent and product brand in a unique string of 43-59 chars including spaces
33
description: "Learn about the security that applies to sharing and assigning records." # 115-145 characters including spaces. This abstract displays in the search result.
4-
ms.date: 08/22/2022
4+
ms.date: 06/06/2023
55
ms.reviewer: pehecke
66
ms.topic: article
77
author: paulliew # GitHub ID
@@ -14,12 +14,12 @@ search.audienceType:
1414

1515
[!INCLUDE[cc-terminology](includes/cc-terminology.md)]
1616

17-
In this article we will look at the security access when sharing and assigning records.
17+
In this article, we'll look at security access when sharing and assigning records.
1818

1919
## Sharing records
2020

2121
Sharing lets users give other users or teams access to specific customer
22-
information. This is useful for sharing information with users in roles that
22+
information. Sharing records is useful for sharing information with users in roles that
2323
have only the **Basic** access level. For example, in an organization that gives
2424
salespeople **Basic** read and write access to accounts, a salesperson can share an
2525
opportunity with another salesperson so that they can both track the progress of
@@ -33,26 +33,181 @@ specific access rights, and they might also be on a team in which the same
3333
record is shared with different access rights. In this case, the access rights
3434
that this user has on the record are the union of all the rights.
3535

36-
When you share a record with another user using the `GrantAccess` message (<xref:Microsoft.Dynamics.CRM.GrantAccess> action, <xref:Microsoft.Crm.Sdk.Messages.GrantAccessRequest> class), or modify access using the `ModifyAccess` message (<xref:Microsoft.Dynamics.CRM.ModifyAccess> action, <xref:Microsoft.Crm.Sdk.Messages.ModifyAccessRequest> class), you must indicate what access rights you want to
37-
grant to the other user. Access rights on a shared record can be different for
38-
each user with whom the record is shared. However, you cannot give a user any
39-
rights that they would not have for that type of table, based on the role
40-
assigned to that user. For example, if a user does not have **Read** privileges on
41-
accounts and you share an account with that user, the user will be unable to see
36+
When you share a record with another user using the `GrantAccess` message, you must indicate what access rights you want to
37+
grant to the other user. To modify the access of a shared record, use the `ModifyAccess` message. Access rights on a shared record can be different for each user with whom the record is shared. However, you can't give a user any
38+
rights that they wouldn't have for that type of table, based on the role
39+
assigned to that user. For example, if a user doesn't have **Read** privileges on
40+
accounts and you share an account with that user, the user is unable to see
4241
that account.
4342

44-
### Sharing and inheritance
43+
### GrantAccess example
44+
45+
These examples show the use of the `GrantAccess` message to share a record with another principal.
46+
47+
#### [SDK for .NET](#tab/sdk)
48+
49+
The following `ShareRecord` static method shows how to use the [PrincipalAccess Class](xref:Microsoft.Crm.Sdk.Messages.PrincipalAccess) to specify a reference to a principal (user, team, or organization) with a set of [AccessRights](xref:Microsoft.Crm.Sdk.Messages.AccessRights) that contain the rights that to be granted to the principal.
50+
51+
```csharp
52+
/// <summary>
53+
/// Shares a record with a principal
54+
/// </summary>
55+
/// <param name="service">Authenticated client implementing the IOrganizationService interface</param>
56+
/// <param name="principal">The user, team, or organization to share the record with.</param>
57+
/// <param name="access">The access rights to grant</param>
58+
/// <param name="record">The record to share</param>
59+
static void ShareRecord(
60+
IOrganizationService service,
61+
EntityReference principal,
62+
AccessRights access,
63+
EntityReference record)
64+
{
65+
66+
PrincipalAccess principalAccess = new()
67+
{
68+
AccessMask = access,
69+
Principal = principal
70+
};
71+
72+
GrantAccessRequest request = new()
73+
{
74+
PrincipalAccess = principalAccess,
75+
Target = record
76+
};
77+
78+
service.Execute(request);
79+
}
80+
```
81+
82+
#### [Web API](#tab/webapi)
83+
84+
The following example shows the use of the [GrantAccess Action](xref:Microsoft.Dynamics.CRM.GrantAccess) using the [PrincipalAccess ComplexType](xref:Microsoft.Dynamics.CRM.PrincipalAccess) to specify the principal (user, team, or organization) and level of access to grant using the values in the [AccessRights EnumType](xref:Microsoft.Dynamics.CRM.AccessRights).
85+
86+
**Request**
87+
88+
```http
89+
POST [Organization Uri]/api/data/v9.2/GrantAccess
90+
OData-MaxVersion: 4.0
91+
OData-Version: 4.0
92+
If-None-Match: null
93+
Accept: application/json
94+
Content-Type: application/json; charset=utf-8
95+
Content-Length: 361
96+
97+
{
98+
"Target": {
99+
"accountid": "e41ac31a-dcdf-ed11-a7c7-000d3a993550",
100+
"@odata.type": "Microsoft.Dynamics.CRM.account"
101+
},
102+
"PrincipalAccess": {
103+
"AccessMask": "WriteAccess, DeleteAccess",
104+
"Principal": {
105+
"systemuserid": "7761da90-2383-e911-a962-000d3a13c05d",
106+
"@odata.type": "Microsoft.Dynamics.CRM.systemuser"
107+
}
108+
}
109+
}
110+
```
111+
112+
**Response**
113+
114+
```http
115+
HTTP/1.1 204 NoContent
116+
OData-Version: 4.0
117+
```
118+
119+
---
120+
121+
### ModifyAccess example
122+
123+
These examples show the use of the `ModifyAccess` message to change the access granted to a principal for a shared record.
124+
125+
#### [SDK for .NET](#tab/sdk)
126+
127+
The following `ModifyShare` static method shows how to use the [PrincipalAccess Class](xref:Microsoft.Crm.Sdk.Messages.PrincipalAccess) to specify a reference to a principal (user, team, or organization) with a set of [AccessRights](xref:Microsoft.Crm.Sdk.Messages.AccessRights) that contain the rights that will be modified for the principal.
128+
129+
```csharp
130+
/// <summary>
131+
/// Modifies the access to a shared record.
132+
/// </summary>
133+
/// <param name="service">Authenticated client implementing the IOrganizationService interface</param>
134+
/// <param name="principal">The user, team, or organization to modify rights to the shared.</param>
135+
/// <param name="access">The access rights to modify</param>
136+
/// <param name="record">The shared record</param>
137+
static void ModifyShare(
138+
IOrganizationService service,
139+
EntityReference principal,
140+
AccessRights access,
141+
EntityReference record)
142+
{
143+
PrincipalAccess principalAccess = new()
144+
{
145+
AccessMask = access,
146+
Principal = principal
147+
};
148+
149+
ModifyAccessRequest request = new()
150+
{
151+
152+
PrincipalAccess = principalAccess,
153+
Target = record
154+
};
155+
156+
service.Execute(request);
157+
}
158+
```
159+
160+
#### [Web API](#tab/webapi)
161+
162+
The following example shows the use of the [ModifyAccess Action](xref:Microsoft.Dynamics.CRM.ModifyAccess) using the [PrincipalAccess ComplexType](xref:Microsoft.Dynamics.CRM.PrincipalAccess) to specify the principal (user, team, or organization) and level of access to modify using the values in the [AccessRights EnumType](xref:Microsoft.Dynamics.CRM.AccessRights).
163+
164+
**Request**
165+
166+
```http
167+
POST [Organization Uri]/api/data/v9.2/ModifyAccess
168+
OData-MaxVersion: 4.0
169+
OData-Version: 4.0
170+
If-None-Match: null
171+
Accept: application/json
172+
Content-Type: application/json; charset=utf-8
173+
Content-Length: 388
174+
175+
{
176+
"Target": {
177+
"accountid": "e41ac31a-dcdf-ed11-a7c7-000d3a993550",
178+
"@odata.type": "Microsoft.Dynamics.CRM.account"
179+
},
180+
"PrincipalAccess": {
181+
"AccessMask": "WriteAccess, DeleteAccess, ShareAccess, AssignAccess",
182+
"Principal": {
183+
"systemuserid": "7761da90-2383-e911-a962-000d3a13c05d",
184+
"@odata.type": "Microsoft.Dynamics.CRM.systemuser"
185+
}
186+
}
187+
}
188+
```
189+
190+
**Response**
191+
192+
```http
193+
HTTP/1.1 204 NoContent
194+
OData-Version: 4.0
195+
```
196+
197+
---
198+
199+
## Sharing and inheritance
45200

46201
If a record is created and the parent record has certain sharing properties, the
47202
new record inherits those properties. For example, Joe and Mike are working on a
48203
high priority lead. Joe creates a new lead and two activities, shares the lead
49204
with Mike, and selects cascade sharing. Mike makes a telephone call and sends an
50205
email regarding the new lead. Joe sees that Mike has contacted the company two
51-
times, so Joe does not make another call.
206+
times, so Joe doesn't make another call.
52207

53208
Sharing is maintained on individual records. A record inherits the sharing
54209
properties from its parent and maintains its own sharing properties. Therefore,
55-
a record can have two sets of sharing properties — one that it has on its own, and
210+
a record can have two sets of sharing properties—one that it has on its own, and
56211
one that it inherits from its parent.
57212

58213
Removing the share of a parent record removes the sharing properties of objects
@@ -64,24 +219,91 @@ from the parent record.
64219
## Assigning records
65220

66221
Anyone with **Assign** access rights on a record can assign that record to
67-
another user. When a record is assigned, the new user or team becomes the owner
68-
of the record and its related records. The original user or team loses ownership
222+
another user. To assign a record, change the `ownerid` lookup value to refer to a new principal.
223+
224+
> [!NOTE]
225+
> The SDK has an [AssignRequest class](xref:Microsoft.Crm.Sdk.Messages.AssignRequest) that is deprecated. More information: [Legacy update messages](org-service/entity-operations-update-delete.md#legacy-update-messages)
226+
227+
When a record is assigned, the new user, team or organization becomes the owner
228+
of the record and its related records. The original user, team or organization loses ownership
69229
of the record, but automatically shares it with the new owner.
70230

71231
In Microsoft Dataverse, the system administrator can decide for an organization
72232
whether records should be shared with previous owners or not after the assign
73233
operation. If **Share reassigned records with original owner** is selected (see **System Settings** > **General**), then the previous owner
74234
shares the record with all access rights after the assign operation. Otherwise,
75-
the previous owner does not share the record and may not have access to the
235+
the previous owner doesn't share the record and may not have access to the
76236
record, depending on their privileges. The Organization table's
77237
[ShareToPreviousOwnerOnAssign](reference/entities/organization.md#sharetopreviousowneronassign-choicesoptions) column controls this setting.
78238

79239
> [!NOTE]
80-
> The [Appointment table](reference/entities/appointment.md) has special logic which is used when an appointment is assigned to another user. If the current owner is still a participant such as the organizer or an attendee, the appointment record is shared with this user when the appointment is reassigned. This behavior occurs even if the **Share reassigned records with original owner** setting is disabled. Because the appointment may be shared with the previous owner, the user assigning the meeting requires both the **Assign** and **Share** access rights on the record.
240+
> The [Appointment table](reference/entities/appointment.md) has special logic when an appointment is assigned to another user. If the current owner is still a participant, such as the organizer or an attendee, the appointment record is shared with this user when the appointment is reassigned. This behavior occurs even if the **Share reassigned records with original owner** setting is disabled. Because the appointment may be shared with the previous owner, the user assigning the meeting requires both the **Assign** and **Share** access rights on the record.
81241
82242
## Revoking access
83243

84-
As the owner of a record, you can revoke (remove) user access to your shared record. To do so, use the `RevokeAccess` message (<xref:Microsoft.Dynamics.CRM.RevokeAccess> action, <xref:Microsoft.Crm.Sdk.Messages.RevokeAccessRequest> class).
244+
The owner of the record can use the `RevokeAccess` message to revoke (remove) user access to the shared record.
245+
246+
### [SDK for .NET](#tab/sdk)
247+
248+
The following `RevokeShare` static method shows how to remove sharing access for a user to a record using the [RevokeAccessRequest Class](xref:Microsoft.Crm.Sdk.Messages.RevokeAccessRequest).
249+
250+
```csharp
251+
/// <summary>
252+
/// Revokes access to a shared record.
253+
/// </summary>
254+
/// <param name="service">Authenticated client implementing the IOrganizationService interface</param>
255+
/// <param name="principal">The user, team, or organization to revoke rights to the shared record.</param>
256+
/// <param name="record">The shared record</param>
257+
static void RevokeShare(
258+
IOrganizationService service,
259+
EntityReference principal,
260+
EntityReference record)
261+
{
262+
RevokeAccessRequest request = new()
263+
{
264+
Revokee = principal,
265+
Target = record
266+
};
267+
268+
service.Execute(request);
269+
}
270+
```
271+
272+
### [Web API](#tab/webapi)
273+
274+
The following example shows how to use the [RevokeAccess Action](xref:Microsoft.Dynamics.CRM.RevokeAccess) to remove sharing access for a user to a record. In this example, a user is the `Revokee`, and an account record is the `Target`.
275+
276+
**Request**
277+
278+
```http
279+
POST [Organization Uri]/api/data/v9.2/RevokeAccess
280+
OData-MaxVersion: 4.0
281+
OData-Version: 4.0
282+
If-None-Match: null
283+
Accept: application/json
284+
Content-Type: application/json; charset=utf-8
285+
Content-Length: 274
286+
287+
{
288+
"Target": {
289+
"accountid": "e41ac31a-dcdf-ed11-a7c7-000d3a993550",
290+
"@odata.type": "Microsoft.Dynamics.CRM.account"
291+
},
292+
"Revokee": {
293+
"systemuserid": "7761da90-2383-e911-a962-000d3a13c05d",
294+
"@odata.type": "Microsoft.Dynamics.CRM.systemuser"
295+
}
296+
}
297+
```
298+
299+
**Response**
300+
301+
```http
302+
HTTP/1.1 204 NoContent
303+
OData-Version: 4.0
304+
```
305+
306+
---
85307

86308
More information: [Shared access](/power-platform/admin/how-record-access-determined#shared-access.md)
87309

‎powerapps-docs/maker/data-platform/azure-synapse-link-synapse.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: "Create an Azure Synapse Link for Dataverse with your Azure Synapse Workspace | MicrosoftDocs"
33
description: "Learn how to export table data to Azure Synapse Analytics in Power Apps"
44
ms.custom: ""
5-
ms.date: 02/23/2023
5+
ms.date: 06/06/2023
66
ms.reviewer: "Mattp123"
77
ms.suite: ""
88
ms.tgt_pltfrm: ""
@@ -134,7 +134,8 @@ After creating an Azure Synapse Link, two versions of the table data will be syn
134134
- Snapshot data: Provides a read-only copy of near real-time data that is updated at regular intervals (in this case every hour). 
135135

136136
> [!NOTE]
137-
> For empty table data and metadata table, only near real-time data is created.
137+
> For empty table data and metadata tables, only near real-time data is created.
138+
> To create read-only snapshot data, ensure that the **Permitted scope for copy operations** setting is configured to **From any storage account**. More information: [Configure the permitted scope for copy operations]( /azure/storage/common/security-restrict-copy-operations?tabs=portal#configure-the-permitted-scope-for-copy-operations-preview)
138139
139140
1. Select the desired Azure Synapse Link, and then select the **Go to Azure Synapse Analytics workspace** from the top panel.
140141
1. Expand **Lake Databases** from the left panel, select **dataverse**-*environmentName*-*organizationUniqueName*, and then expand **Tables**.

0 commit comments

Comments
 (0)