|
| 1 | +--- |
| 2 | +title: Configure column permissions for portals |
| 3 | +description: Configure column permissions for use with the portals Web API. |
| 4 | +author: neerajnandwana-msft |
| 5 | +ms.service: powerapps |
| 6 | +ms.topic: conceptual |
| 7 | +ms.custom: |
| 8 | +ms.date: 02/01/2022 |
| 9 | +ms.subservice: portals |
| 10 | +ms.author: nenandw |
| 11 | +ms.reviewer: ndoelman |
| 12 | +contributors: |
| 13 | + - nickdoelman |
| 14 | + - neerajnandwana-msft |
| 15 | +--- |
| 16 | + |
| 17 | +# Configure column permissions |
| 18 | + |
| 19 | +[Table permissions](assign-entity-permissions.md) are used to apply security in portals to individual Dataverse table records. You can add **column permissions** to individual table columns. Column permissions are an optional configuration that are associated with [web roles](create-web-roles.md). |
| 20 | + |
| 21 | +> [!NOTE] |
| 22 | +> Column permissions are currently only applicable for [portal Web API](../web-api-overview.md) features. |
| 23 | +
|
| 24 | +Web roles can have any number of table permissions and column permissions. If web role has multiple column permissions, then all column permissions are applied to the selected web role. |
| 25 | + |
| 26 | +When evaluating the permissions, table permissions are evaluated first. If a user has access to table then respective table's column permissions will be applied. If the user doesn't have access to table, then any column permissions configuration will be ignored. |
| 27 | + |
| 28 | +When no column permissions are defined, then corresponding table permissions will apply to all columns. |
| 29 | + |
| 30 | +> [!Important] |
| 31 | +> This feature requires the following versions for starter portal package and portal host: |
| 32 | +> - Portal host version 9.4.1.x or later. |
| 33 | +> - Starter portal package version 9.3.2201.x or later. |
| 34 | +
|
| 35 | +## Add column permissions to a web role |
| 36 | + |
| 37 | +1. Open the [Portal Management app](configure-portal.md). |
| 38 | + |
| 39 | +1. Go to **Portals** > **Web Roles** and open the web role that you want to add column permissions. |
| 40 | + |
| 41 | +1. Under **Related**, select **Column Permission Profiles**. |
| 42 | + |
| 43 | +1. Select **Add Existing Column Permission Profiles** to add an existing column permission to a web role. |
| 44 | + |
| 45 | +1. Browse for a column permission profile or select **New Column Permission Profiles** to create a new column permission profile record. |
| 46 | + |
| 47 | + :::image type="content" source="media/column-permissions/column-permission-profiles.png" alt-text="Adding column permission profiles."::: |
| 48 | + |
| 49 | +## Attributes and relationships |
| 50 | + |
| 51 | +:::image type="content" source="media/column-permissions/manage-column-permission.png" alt-text="Managing column permissions."::: |
| 52 | + |
| 53 | +The following table explains the table permission attributes. |
| 54 | + |
| 55 | +| **Name** | **Description** | |
| 56 | +|-------------------------|-------------------------| |
| 57 | +| Profile Name | The descriptive name of the record. This field is required. | |
| 58 | +| Table Name | The logical name of the table that column is to be secured. This field is required. | |
| 59 | +| Website | The associated website. This field is required. | |
| 60 | +| All Column Permissions | This setting will allow users to limit table permission access scope. It's a multiple selection field. For example, the table permission allows the user to **Create**, **Read** all columns. Using this setting, you can further limit to only read permissions for all columns.</br></br>Available permissions:<ul><li>Create</li><li>Read</li><li>Update</li></ul></br>This configuration is useful when you want a specific web role to be able to read all contact fields but allow updates to the first name, and last name columns. You have to select **Read** option for the **All Column Permissions** setting and create column permission records for the first name, and last name columns with read and update permissions. | |
| 61 | +| Column Permissions | The associated column permissions. This allows users to define specific permissions for table columns. Columns not defined here will follow the **All Column Permissions** setting. | |
| 62 | +| Web Roles | The associated web roles. | |
| 63 | + |
| 64 | +## Examples |
| 65 | + |
| 66 | +In this example, we have the contact table with the columns; *JobTitle* and *Salary*. |
| 67 | + |
| 68 | +The following table demonstrates the result of applying different column and table permissions to the contact table and the additional columns. |
| 69 | + |
| 70 | +| **Table Permission** | **Site Setting**<br><em>**Webapi/contact/enabled**</em> | **Site Setting**<br><em>**Webapi/contact/fields**</em> | **Column Permission** | **Scenario** | |
| 71 | +|-------------------------|-------------------------|-------------------------|-------------------------|-------------------------| |
| 72 | +| Contact (Create, Read, Update) | TRUE | | | User will not have any permissions to the columns. | |
| 73 | +| Contact (Create, Read, Update) | FALSE | | | User will not have any permissions to the columns. | |
| 74 | +| Contact (<none>) | TRUE | * | **All Column Permissions:** Create, Read, Update</br>**Column Permissions:** <none> | User will not have any permissions to the columns. | |
| 75 | +| Contact (Create, Read, Update) | TRUE | * | | User will have Create, Read, Update permissions on all contact table columns. | |
| 76 | +| Contact (Create, Read, Update) | TRUE | | **All Column Permissions:** Create, Read, Update</br>**Column Permissions:** <none> | User will not have any permissions to the columns. | |
| 77 | +| Contact (Create, Read, Update) | TRUE | * | **All Column Permissions:** <none></br>**Column Permissions:**</br><ul></br><li>**JobTitle:** Read</li></br></ul> | User will have Read on JobTitle and Create, Read, Update on all the other columns. | |
| 78 | +| Contact (Create, Read, Update) | TRUE | * | **All Column Permissions:** Read</br>**Column Permissions:**</br><ul></br><li>**JobTitle:** Create, Read, Update</li></br></ul> | User will have Create, Read, Update on JobTitle and only Read on all the other columns. | |
| 79 | +| Contact (Create, Read, Update) | TRUE | JobTitle, Salary | | User will have Create, Read, Update on JobTitle and Salary. | |
| 80 | +| Contact (Create, Read, Update) | TRUE | JobTitle, Salary | **All Column Permissions:** Create, Read, Update</br>**Column Permissions:** <none> | User will have Create, Read, Update on JobTitle and Salary, no permission on other columns. | |
| 81 | +| Contact (Create, Read, Update) | TRUE | JobTitle, Salary | **All Column Permissions:** <none></br>**Column Permissions:**</br><ul></br><li>**JobTitle:** Create, Read, Update</li></br><li>**Salary:** Create, Read, Update</li></br></ul> | User will have Create, Read, Update on JobTitle and Salary. | |
| 82 | +| Contact (Create, Read, Update) | TRUE | JobTitle | **All Column Permissions:** <none></br>**Column Permissions:**</br><ul></br><li>**JobTitle:** Create, Read, Update</li></br><li>**Salary:** Create, Read, Update</li></br></ul> | User will have Create, Read, Update on JobTitle and no permission on Salary. | |
| 83 | +| Contact (Create, Read, Update) | TRUE | JobTitle, Salary | **All Column Permissions:** <none></br>**Column Permissions:**</br><ul></br><li>**JobTitle:** Create, Read, Update</li></br><li>**Salary:** Read</li></br></ul> | User will have Create, Read, Update on JobTitle, and Read on Salary. | |
| 84 | + |
| 85 | +### See also |
| 86 | + |
| 87 | +[Assign table permissions](assign-entity-permissions.md)</br> |
| 88 | +[Create web roles for portals](create-web-roles.md)</br> |
| 89 | +[Portals Web API overview](../web-api-overview.md) |
| 90 | + |
| 91 | +[!INCLUDE[footer-include](../../../includes/footer-banner.md)] |
0 commit comments