No video :(

PowerApps Security, Environments, and Plan 2

Подписаться 164 тыс.

Просмотров 43 тыс.

50% 1

In this video, you will learn about PowerApps Security, Environments, and how you can do it better with A plan 2 license.
Video on getting started with PowerApps SQL • Azure SQL Database tut...
If you need help, training, or consulting check out www.PowerApps9...

Опубликовано:

5 сен 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 165

@AlbertodaSilva1972 4 года назад

You can keep the SharePoint back-end and add a Power Automate workflow to set item level security when item is created on SP list. That way, the user can only see and edit their own requests. In that case, even if they go to the SP list they can only see their own items. This will also make the additional step of adding filters in PowerApps redundant as it will only pull data user has access to.

@ShanesCows 4 года назад

Thanks for sharing 🤩

@cvkealey 5 лет назад

Great video as always, Shane. For those of us that are "stuck" using SharePoint as a data source, it'd be great to get a more detailed look at the workarounds that you've found for "securing" those sources. My favorites are hiding the list from the browser and/or (where that's not practical) adding a PowerApps customized form to prevent folks from making changes to list items outside of the designated Apps.

@ShanesCows 5 лет назад

Those are great examples. 😀

@AlbertodaSilva1972 4 года назад

Use Power Automate workflow to set item level security on item creation on SP list. That way, the user can only view their own items, even if they have access to the list.

@Stinow 3 года назад

Liking this stuff before hitting 'play'. Shane's becoming a legend.

@ShanesCows 3 года назад

Thanks for the support! 🐶

@keaklaassen5340 2 года назад

Once again saved by you Shane, where are the flowers supposed to go?

@ShanesCows 2 года назад

Kea you just keep making awesome stuff and I will be happy. 🐶

@davidmckenzie1889 4 года назад

Shane, in SharePoint it is possible to create a permission level that excludes "View Application Pages" under list permissions, which stops the user seeing the list in SharePoint, including view, edit and add forms. As long as they still have read, edit, add and delete permissions the App will work. Probably still a "security by obscurity" option as I'm sure they could still use API to do what they like, or link to the table with MS Access, but it remove all but most IT-savvy user. And thanks for your videos - I'm slowly catching up on the last 2 years!

@ShanesCows 4 года назад

Interesting idea 😀

@Ylotan 5 лет назад

Many thanks for explaining how to secure SQL connector in PROD environment. That was my upcoming consideration. Also, regarding SharePoint list as PowerApps data source security - my idea would be to perform App registration in Azure portal and create a custom REST API connector with obtained AppID/credentials. This way PowerApp would connect to SP using AppID account instead. No need to grant permissions for end user. I should probably make a proof of concept if I gate a chance to have sufficient rights in my ENV.

@ShanesCows 5 лет назад

Love the idea

@sylvie8095 Год назад

Shane Young is out here doing God's work...and solving things Microsoft should probably pay entire teams to deal with :P What would we do without you Shane?!

@gustavocanelonmd9036 4 года назад

Thanks for this video Shane, a must see for anybody sharing an app. Also, a lot of fun to watch.

@ShanesCows 4 года назад

Thanks 😊

@fahimshekaib 5 лет назад

Thanks, Shane. At minute 6:50 you mention that you don't love hiding SharePoint site. You did mention how Environments will protect SQL connection and the app as the user won't be able to see the "Secure" or protected Environment, but you did not clarify how Environments can help in data security of an app that is using SharePoint Lists as its data source. I hope I haven't missed something in the video. Could you please clarify this point?

@ShanesCows 5 лет назад

Environments don't help in securing SharePoint lists at all. :(

@thanghuu887 3 года назад

@@ShanesCows that's bad.

@saschahausler6286 3 года назад

Thank you for this great video. Just figured out that the reader (in your case chevy) is able to access the secure environment if he typed the guid of the secure-environment in the url. By doing so the user can see all connections and apps but has no edit permissions and therefore can't use the connector.

@ShanesCows 3 года назад

Thanks for the info!

@bod52YOU 2 года назад

Excellent. Thank you Shane!

@ShanesCows 2 года назад

Happy to help. Have a great day. 🐶

@andresmunoz2786 Год назад

Thanks for this video. It's very clear to understand. I have an issue with my SQL Connection. My App works well with the connector if I use directly in My App, but I have some problems using with a Power Automate Connection which is called from my App. This PA call a SQL store procedure and give back some info to my App. Since I configure Imlicit connection, it doesn't work.

@DaytoDayDynamics365 5 лет назад

Good stuff Shane! A vid every admin and maker should watch!

@ShanesCows 5 лет назад

Thank you. You are very kind.

@seamusobric 4 года назад

Great video! Seriously thank you so much, best powerapps teacher on RU-vid!

@ShanesCows 4 года назад

Wow, thanks! 🤗

@Nick.Anselmo 5 лет назад

Great video as always Shane! Just wanted to say two things: #1 - super great idea with the new SOP, creating the other environment. #2 - on the Analytics Report (which uses Power BI) when you saw United States, there should be the ability to “drill down” or expand downwards to see the hierarchy, Country, State, City, etc. Give me a thumbs up if that drill down works for you. Otherwise, keep up the fantastic work!

@ShanesCows 5 лет назад

No drilldown for me either :(

@bradhunnings5428 4 года назад

Great video. This covers exactly the security concerns we were having. Now to just get that P2 license...

@facundovaccaro6918 4 года назад

Shane you are the best! Love your videos!

@ShanesCows 4 года назад

Thank you for the kind words

@juanspottorno5615 3 года назад

Thanks Shane, I have one question, how can you solve the problem if you use SharePoint as data source? I guess you would have to limit and personalize permissions in SharePoint lists. Is there anything "environments" can do to help manage this?

@shingomcleod 5 лет назад

Thanks for this Shane, very timely ahead of MBAS, one of our slides we're presenting is specifically on this topic, but I have 1.5mins to cover it vs your 27! Haha

@ShanesCows 5 лет назад

One of my slides also covers it. So that is why I finally bit the bullet and made the video so I can link to it. Be sure to stop and say hello if you get a chance.

@helpme77008 5 лет назад

This is a great video. I have some thing like a simple suggestion box powerapp that is connected to SharePoint list that list has items on it I do not want visible. I would like to make it where we have two classes of uses normal cannot see or access the list and admins can see the full list. Maybe this is more of a SharePoint Security Video and not a powerapps ones but am in need. Your videos rock! Please keep making them. I am very new to SharePoint/PowerApps and cant spell SQL if you know what I mean.

@ShanesCows 5 лет назад

Try looking at Approvals in SharePoint. Might get you close.

@martinargimon730 2 года назад

excellent !! thanks

@ShanesCows 2 года назад

You are welcome!

@dollylover1979 5 лет назад

Hi Shane. Great video as always. One thing that's struck me watching a lot of the videos from the recent MS Business Apps summit 2019 is the number of big companies who appear to be using Sharepoint as their data source (including a transatlantic airline and a European rail company). Am I missing something or are these big enterprises finding a way to manage the security issues you raise with Sharepoint lists?

@ShanesCows 5 лет назад

I don’t think so. They are just building departmental solutions that security isn’t an issue I would guess.

@accsanagustin4710 4 года назад

Thank You for providing such informative videos. Could you post more videos regarding security. It is a bit different now with admin.powerapps changing to admin.powerplatform. Again, thank you for all the videos you post.

@ShanesCows 4 года назад

Will add it to my list. 😀

@iamdhruvinshah 5 лет назад

I have 2 quick questions. 1. What's the difference between Trial and Production environment? 2. In PowerApps is it possible that, one of my app is always be in production. One will be in development.. Whenever development completed it is moved to the production?

@mitshot60 5 лет назад

RE #1 - The main difference is that a trial environment only lives for 30 days before it is deleted. Production environments are permanent, and require production capacity to create: powerapps.microsoft.com/blog/provisioning-and-administration-is-getting-easier/. RE #2 - It really depends on how you are structuring your "development app" vs your "production app" and which type of app it is: 1. If you are just building a canvas app - your 'development' app can just be the working draft of the same production app. And when you are ready you can 'publish' it to all of the users who have access: docs.microsoft.com/powerapps/maker/canvas-apps/save-publish-app 2. If you have a more complex app, including model-driven apps against CDS, you could consider creating separate "developer" and "live production" environments. This is important because you will be making metadata changes that can introduces conflicts in the same environment. In this scenario you will need to have an application lifecycle management process using solutions to transport your changes from development and publish to production: powerapps.microsoft.com/blog/alm-at-scale-new-features-and-automation-capabilities/

@ShanesCows 5 лет назад

Thanks James! 👍 In case anyone is wondering these are his features so he is the authority.

@myfirst5952 3 года назад

Hello Shane, I am trying to get the screens visible based on security roles .. so I have tried to get my security roles using clearcollect but I am not able to check the screens based on roles

@ShanesCows 3 года назад

Try this video ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-0MB-z9cyFCQ.html

@martinwhite2369 2 года назад

Hey Shane. I'm assuming all the things you said about Sharepoint here would apply also to Dataverse?

@ShanesCows 2 года назад

Martin I want to say yes. But I don't remember everything I said. :)

@karijukka-pekkavainio5994 5 лет назад

I would actually like to, even in the default environment, to only allow users to use but NOT create PowerApps. In that case would it also prevent them from customizing sharepoint forms with powerapps

@ShanesCows 5 лет назад

I think so

@hannahtate4188 3 года назад

Shane, this is a very helpful video and I realize it is a little dated, but presumably this still applies today. It sounds like, from a licensing perspective, you would have to have every user licensed in the PowerApps per user or per app plan in order for them to access data outside of the default environment. Does that sound right to you? This approach could get expensive with a large user base. Or, can I just have my admin account maintain that plan, create the additional environments and apply the security configurations mentioned in the video against all my end users without licensing them?

@ShanesCows 3 года назад

As long as the app doesn’t have a premium datasource your users will NOT need a premium license.

@idrissbelamri1929 4 года назад

What's the condition for implicit data source share ; are there a condition for excel sheet to be implicitly shared because I can't have the Share button . IT DOES NOT appears FOR MY SHARED ONE DRIVR EXCEL SHEET

@ShanesCows 4 года назад

You need to share the file in OneDrive

@emilpinter5772 2 года назад

Hi Shane , thanks for great video, my question is if it is possibile add to Enviro Makers also O365 groups instead od individual person.

@hermanesterhuizen632 3 года назад

Shane is their way with code or power automate to password protect document excel and word

@ShanesCows 3 года назад

Not that I know of. You would have to look to see if there is a Graph API call that does it and then go from there.

@vidanaweer1662 5 лет назад

Very good video thanks again Shane, when we add someone to the production environment as app maker that person will be able to edit all apps within the environment? If so how can we setup security based on the app, so only a specific people can edit specific apps? Thanks.

@ShanesCows 5 лет назад

That is default behavior. People can only edit apps they are owner of. But they can use any connection you have shared with them.

@atsarkar 4 года назад

Good one Shane! But I was looking for how users can login to Power Apps Canvas apps.? If I create an App with Username/Pwd , what are the different ways to process User's credentials in a secured way? If I have users who are not in the PowerApp users list how do we consider their Login mechanism? Regards Atanu

@ShanesCows 4 года назад

Everyone who logs into your app has to have an Azure Active Directory account. That is the only way to log in.

@seamusobric 4 года назад

15:03 great video thanks for the information! excellant pls keep making!

@ShanesCows 4 года назад

Thanks 😊

@BrechtGijbels 3 года назад

Great video Shane, thank you :) One question, given that Chewy can't access the PowerApps Secure studio environment, I was wondering if there was a way for him to get a link/url to the app without relying on the e-mail he received?

@ShanesCows 3 года назад

Not that I know of

@myatix1 4 года назад

Great stuff cheers... Two questions... What if you have an app with some content editors and some content readers. How could you achieve this via security rather than visibility or some other hack? To limit access to the SharePoint list could you not change the permissions in the SharePoint list. So instead of them being members they become readers?

@ShanesCows 4 года назад

Yes. As long as they only need read then that is all you have to give them in SharePoint

@gustavoleal3397 3 года назад

Hi Shane, great explanation, I have two questions (maybe already asked): 1 I have an app in PRO environment, how can move to "secure" environment and viceversa?. 2. There is an option on the top that says "Convert to Production" (you don´t have it in your video -26:57), it will replace the original production and will lost the existing apps?

@ShanesCows 3 года назад

2 I don't think so. I believe it just converts the environment to be permanent.

@Christian-vv2hu 4 года назад

Shane, thanks a lot for another great video. I am relative new to Powerapps. Actually I have two main questions 1) is it possible to assign a more meaningful name for a connection than the standard name Sharepoint without any hint to which web-site it provides the connection? 2) how is it possible with Powerapps and SPO or SQL to deal with concurrent users in a reservation app with a great number but also limited articles, for example parking spaces. Is there any thing like transaction support in SPO which prevent that users overwrite an existing reservation? Do you have any suggestions where I can found further information? Thanks a lot Kind regards Christian

@ShanesCows 4 года назад

1 nope. 2 you would have to write the logic to avoid conflict. It can be a pain in the butt. 😑

@manochapallavi 5 лет назад

Hey Shane...looks like an amazing course and excited to learn. Any pointers on- which order should I view ur tutorial to get a deep understanding.I am CRM professional thanks. 🙂

@ShanesCows 5 лет назад

Not really. Learn Powerapps is the first then they go crazy. 😀 we do have proper classes available www.PowerApps911.com/training

@unlimitedduck 5 лет назад

Shane the illustration used for creating a secondary environment to help with SQL can you apply the same principles using the secondary environment but with a SharePoint list?

@ShanesCows 5 лет назад

SharePoint is a bit different. SharePoint is about permissions to the list.

@leonards2808 4 года назад

Hello, First of all, thanks a lot for making those videos. They really help and are really informative. One quick question at the license level: SQL Connection (as CDS) requires the use of a premium connector. If I get a premium license, I should be able to access those. However, when sharing the app (even in a secure environment) to other users, as I am "implicitly" sharing the SQL connection, does that mean that the app user can use the app? My understanding is the following: users will be leveraging my connection. Therefore, my assumption is that they should be ok using the app with a basic license (the one that comes out of the box with an office 365 license). Is that correct? Or, do they need to upgrade their licenses? Thanks in advance for your answer, Cheers, Leonard

@ShanesCows 4 года назад

If your app has a premium connector (like sql or cds) then all users of the app have to have a premium license. So in your case everyone needs a premium license

@dylanaccorti1044 4 года назад

Shane - Thanks for this video! Super helpful when navigating the dilemma of implicitly shared connections. Taking this one step further, if an app is created in a "secure" environment that we spin up and shared with other users who do not have maker privileges in that environment, can they use that app through the PowerApps visual in Power BI? If so, do we need to share the app with all users that also have access to the PowerBI app for them to be able to interact with it?

@ShanesCows 4 года назад

I haven’t tried before but I think the answer is yes. As long as you share the app with all of the PBI users you should be good

@ricardogonzales2259 3 года назад

Nice explanation shane thanks! I thought envrionments in power apps should work as spaces where we can develop apps and pass it over different environments in order to follow a deployment flow... like and app that was created in a "DevEnvironment", and then pass to "QAEnvironment", then to "StressEnviornment", and finally in a "Production" environment. Is this exists in power apps?

@ShanesCows 3 года назад

Yes, look into Solutions. They allow you to package up your changes from Dev and move to Prod. Not perfect but close.

@aimlezz8855 2 года назад

Hi Shane. Does this method still apply in 2022, or is there a new way to approach this issue? Thanks!

@ShanesCows 2 года назад

Hi Tommy. The license stuff is different. The SQL connection stuff is the same. Though you could also setup your SQL connection to use Azure AD instead of SQL and then that would change some of the challenges.

@aimlezz8855 2 года назад

@@ShanesCows Thanks for the reply, Shane. I've followed the video, created a new environment to isolate the connection from end users, and it works like a charm. Thanks again. You need more subs, this is useful stuff!

@mariefraser2073 4 года назад

Hi Shane, great video and answered what i needed to know about security in SharePoint. I have PowerApps for O365 licence and was looking for Plan 2 - am I correct in saying that this type of licence is no longer available? Can I achieve what you demo'd in your video with my current licence? Does creating an additional environment with CDS come at an additional cost? So it would appear that SQL connections as you described is the only way to secure your data. Does that mean that i would need SQL connectivity licence for every employee in my organisation that potentially would like to use any applications we build? I work for local government and need to ensure data is secure but our solutions are not too costly.

@ShanesCows 4 года назад

Hi Marie. Yes licensing changed. I do think to properly secure your data you will need sql or cds. Both of which requires a premium license

@tessaana3718 4 года назад

Do you have an updated video that covers AD security with a sql connection? For some reason I deleted all of my old implicitly shared connections to an app, and reconnected using AD but its still showing that there is an implicitly shared connection. Not sure why.

@ShanesCows 4 года назад

I don’t yet. Sorry

@praveen7274 4 года назад

Hi Shane, I have a Power Apps Per User Plan and created an environment and app with SQL connector. When I shared an app with E3 users, they were not able to access an app. Can you please explain why users could not access?

@ShanesCows 4 года назад

You need enough per user plans to cover everyone, not just you.

@iamdhruvinshah 5 лет назад

Very useful information..

@ShanesCows 5 лет назад

Glad to help

@kevindibb6534 4 года назад

Could you do a video on using Environment Variables that can change code based on which environment you're in?

@ShanesCows 4 года назад

I haven't used them before but it sounds like something I should look at.

@kasiapolitalska 2 года назад

Hi Shane. Awesome video, thank you! Do you plan to make one to cover Dataverse security too? Pretty please... :)

@ShanesCows 2 года назад

It is on my list for sure. I just keep hoping they will update the UI. Security still uses the old tooling. UGH.

@dollylover1979 4 года назад

Hi Shane. Following the licence changes a couple of months ago, what are the licence requirements to achieve the set-up you recommend in this video? We are Office365 users so we all have access to Power Apps default environment from that. Am I right in saying: To create a new envionment = at least one person will need a 'Power Apps Per User' licence $40/month To run an app that uses the SQL connector (Premium) = every user will require either a 'Per App' licence $10/month of a 'Per User' licence $40/month.

@ShanesCows 4 года назад

James I am not 100% but I think unity can create environments without additional licenses now. Not sure. I need to try. SQL is now premium though.

@evykeskinidis4714 4 года назад

Hi Shane, great video. Just wanted to confirm security with you. Are you saying that there's no way to secure the Sharepoint list from users as they can access and updated bu going directly to the list ? thanks

@ShanesCows 4 года назад

That is correct. You can make it harder for them but in the end they must have access.

@louismartini6983 5 лет назад

Great video Shane! If you use a P2 license to create your PowerApps application using CDS. Can other users who do not have a P2 license use the app? Same for the environments?

@ShanesCows 5 лет назад

They would need a p1 to access cds

@chimmanibalakrishna5976 4 года назад

Thanks for the video, as we started using Power Apps with CDS as source. However users who were able to access/update the data from an Entity, suddenly started to get error message. May i know if you have any suggestion on how to resolve this, thanks in advance

@ShanesCows 4 года назад

CHeck the Role permissions. My CDS series starts here ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-49O1UW-tkyo.html

@CapitaineHugo 5 лет назад

Thanks Shane, this is very useful information. Do we have this documented somewhere? Some text I could reference maybe?

@ShanesCows 5 лет назад

I haven’t written it down. Sorry.

@sagaisaac 5 лет назад

so, if i have one List in Sharepoint connected at PowerApp, the users always can change the data of the List en Sharepoint without occupying the app? :(

@ShanesCows 4 года назад

Yes. Sorry.

@justinpollard5774 3 года назад

Hi Shane, I was wondering if there was a way to use an app in a Test Environment without affecting/impacting live data in SharePoint? If that makes sense. Thanks

@ShanesCows 3 года назад

YEs but you would have to build test lists and such and then change which ones the app is wired to when you move it.

@developermct 3 года назад

Is plan 2 you mention the $10 a month or $40 a month plan from Microsoft?

@ShanesCows 3 года назад

They changed all of the licenses. Now anyone can create an environment but you need to pay for storage

@asimrehan73 3 года назад

Thanks for a great Video Shane... Dose changing environment give similar protection to Sharepoint too ?

@ShanesCows 3 года назад

Nope because you have to grant access to SharePoint directly 😢

@asimrehan73 3 года назад

Thanks Shane ... it is strange that Microsoft didn’t think if it.

@karivaaranen5395 4 года назад

Nice video, thanks! I've been thinking about making any SharePoint list to be read only when there is a need to just read the list. And calling a flow with the data that I want written to a SharePoint list when updating data is required. A flow SHPO connector is authenticated inside the flow and there would not be any need to grant write access rights to the power app users. Obviously this is a bit tedious but wouldn't this work?

@ShanesCows 4 года назад

If Power Apps triggers the flow then it runs in the context of the user. 😑

@rainmaker1011 4 года назад

Great video. I have a question. If I share a Sharepoint list with users but I dont send them an invitation email and I dont tell them the name nor the location of the sharepoint list, how they can access it outside the app? Is there on Sharepoint something like "Shared with me" list of docs,lists? Thx.

@prabhatmishra123 5 лет назад

Great video. Thanks you !

@ehabatme5324 4 года назад

Good Day Shane, this is my first message, but not appreciation for all your contents. My question is: Can we achieve the new environment security with SharePoint Lists? It seems I have P2 License since I have all these features, but when sharing apps with cds backend, they are being requested for a P2 Trial. So I’m stuck with SharePoint Lists.

@ShanesCows 4 года назад

No you cannot secure SharePoint the same way. Sorry

@kimgaskins6966 3 года назад

Hi Shane. Is there a way to logically set the roles of users added to groups in Dynamics 365? I'm a gov employee, we're using Azure to authenticate and powershell to add users to groups but is there a way to assign roles automatically as opposed to manually? we'll be onboarding about 500 users...

@ShanesCows 3 года назад

Not that I know of Kim but I am far from an expert on Dynamics security so not 100% sure

@gustavoleal3397 3 года назад

I followed all steps and still having the message "you are using one or more implicitly shared connections"

@ShanesCows 3 года назад

Correct. It is still shared but the good news is in the second environment they cannot access it to use it. 😀

@Rob-lv6bk 4 года назад

Environments are useless when you are using On-Premise Data Gateways because you can only access them via the default (corporate) environment. This means I have no test or dev environment because they cannot access my test db.

@ShanesCows 4 года назад

It isn’t ideal that is for sure.

@JoeGasper 5 лет назад

Great subject to cover, Shane. And to confirm, there is only the need to have one licensed P2 account to generate the environments and manage the environment's security? Thank you.

@mitshot60 5 лет назад

NOTE: today each PowerApps Plan 2 license only grants you 2 environments to provision, so if you only needed that then that is correct. HOWEVER, I'm happy to call-out that we are removing the Plan 2 license requirement for admins in the next couple of months as outlined here: powerapps.microsoft.com/blog/provisioning-and-administration-is-getting-easier/.

@ShanesCows 5 лет назад

Thanks again James. :)

@woodmanjon 5 лет назад

@@mitshot60 Does this mean that we will be able to remove the maker role from a user without a Plan 2 license? How do the new provisioning rules affect Plan 1 users? Will they be able to create multiple environments that use Azure SQL Server as the back end?

@mitshot60 5 лет назад

@@woodmanjon Q: Does this mean that we will be able to remove the maker role from a user without a Plan 2 license? A: Correct Q: How do the new provisioning rules affect Plan 1 users? A: They would be able to create and manage environments the same as P2 users can today. Not impact to their current capabilities. Q: Will they be able to create multiple environments that use Azure SQL Server as the back end? A: Yes, as long as there is available capacity in their organization to create those additional environments

@woodmanjon 5 лет назад

@@mitshot60 that's amazing!! Thank-you!!

@felixrodriguez4727 5 лет назад

Is posible to do a rol interface for different users in power apps and call a different table in excel por each one of the users ?

@felixrodriguez4727 5 лет назад

Can be done by VB lenguaje ?

@ShanesCows 5 лет назад

Yes I have built multilingual apps like this with if formulas. 😀

@Acidrs 5 лет назад

Great information. While i don't use sql connections and mainly use SharePoint, the sql info is still interesting. For SharePoint, would setting users up as read only permissions stop those users that have been shared the app the ability to edit the list or library, but still be able to see the data in the PowerApp?

@helloanurag 5 лет назад

Yes, if you give them access to read SP list, they will not see the data coming from SP to PA but they won't be able to edit the data. This is what Shane has discussed in this video, if they somehow find your list, they can edit, wipe, download the entire data as they have access to the Sharepoint List. Unfortunately, same theory goes for Microsoft Flow too if you have lined it with your PowerApps. I am surprised to see Shane didn't mention about it. You will have to make your users Co-Owner of the Flow too (no Run only permission here for PA type), and hence if they find your Flow (which is pretty easy by logging in to Flow website), they can do a lot of damage to the entire process or make it a paralysed Flow! MSFT has a long way to go for this.

@CustersBart 5 лет назад

Before I was into PowerApps, I used SharePoint Designer Workflows to remove List permissions and set permission on each record itself. I didn't tested it yet, but i suppose that would still be an option. MS Flow should also work of course.