PowerApps Security, Environments, and Plan 2
ฝัง
- เผยแพร่เมื่อ 13 ต.ค. 2024
- In this video, you will learn about PowerApps Security, Environments, and how you can do it better with A plan 2 license.
Video on getting started with PowerApps SQL • Azure SQL Database tut...
If you need help, training, or consulting check out www.PowerApps9...
Great video as always, Shane. For those of us that are "stuck" using SharePoint as a data source, it'd be great to get a more detailed look at the workarounds that you've found for "securing" those sources. My favorites are hiding the list from the browser and/or (where that's not practical) adding a PowerApps customized form to prevent folks from making changes to list items outside of the designated Apps.
Those are great examples. 😀
Use Power Automate workflow to set item level security on item creation on SP list. That way, the user can only view their own items, even if they have access to the list.
Liking this stuff before hitting 'play'. Shane's becoming a legend.
Thanks for the support! 🐶
You can keep the SharePoint back-end and add a Power Automate workflow to set item level security when item is created on SP list. That way, the user can only see and edit their own requests. In that case, even if they go to the SP list they can only see their own items. This will also make the additional step of adding filters in PowerApps redundant as it will only pull data user has access to.
Thanks for sharing 🤩
Thanks for this video Shane, a must see for anybody sharing an app. Also, a lot of fun to watch.
Thanks 😊
Once again saved by you Shane, where are the flowers supposed to go?
Kea you just keep making awesome stuff and I will be happy. 🐶
Shane, in SharePoint it is possible to create a permission level that excludes "View Application Pages" under list permissions, which stops the user seeing the list in SharePoint, including view, edit and add forms. As long as they still have read, edit, add and delete permissions the App will work. Probably still a "security by obscurity" option as I'm sure they could still use API to do what they like, or link to the table with MS Access, but it remove all but most IT-savvy user.
And thanks for your videos - I'm slowly catching up on the last 2 years!
Interesting idea 😀
Thank you for this great video. Just figured out that the reader (in your case chevy) is able to access the secure environment if he typed the guid of the secure-environment in the url. By doing so the user can see all connections and apps but has no edit permissions and therefore can't use the connector.
Thanks for the info!
Thanks, Shane. At minute 6:50 you mention that you don't love hiding SharePoint site. You did mention how Environments will protect SQL connection and the app as the user won't be able to see the "Secure" or protected Environment, but you did not clarify how Environments can help in data security of an app that is using SharePoint Lists as its data source. I hope I haven't missed something in the video. Could you please clarify this point?
Environments don't help in securing SharePoint lists at all. :(
@@ShanesCows that's bad.
Hi Shane. Great video as always. One thing that's struck me watching a lot of the videos from the recent MS Business Apps summit 2019 is the number of big companies who appear to be using Sharepoint as their data source (including a transatlantic airline and a European rail company). Am I missing something or are these big enterprises finding a way to manage the security issues you raise with Sharepoint lists?
I don’t think so. They are just building departmental solutions that security isn’t an issue I would guess.
Many thanks for explaining how to secure SQL connector in PROD environment. That was my upcoming consideration.
Also, regarding SharePoint list as PowerApps data source security - my idea would be to perform App registration in Azure portal and create a custom REST API connector with obtained AppID/credentials.
This way PowerApp would connect to SP using AppID account instead. No need to grant permissions for end user.
I should probably make a proof of concept if I gate a chance to have sufficient rights in my ENV.
Love the idea
Good stuff Shane! A vid every admin and maker should watch!
Thank you. You are very kind.
Thanks for this video. It's very clear to understand. I have an issue with my SQL Connection. My App works well with the connector if I use directly in My App, but I have some problems using with a Power Automate Connection which is called from my App. This PA call a SQL store procedure and give back some info to my App. Since I configure Imlicit connection, it doesn't work.
Shane Young is out here doing God's work...and solving things Microsoft should probably pay entire teams to deal with :P What would we do without you Shane?!
Great video! Seriously thank you so much, best powerapps teacher on TH-cam!
Wow, thanks! 🤗
Shane, this is a very helpful video and I realize it is a little dated, but presumably this still applies today. It sounds like, from a licensing perspective, you would have to have every user licensed in the PowerApps per user or per app plan in order for them to access data outside of the default environment. Does that sound right to you? This approach could get expensive with a large user base. Or, can I just have my admin account maintain that plan, create the additional environments and apply the security configurations mentioned in the video against all my end users without licensing them?
As long as the app doesn’t have a premium datasource your users will NOT need a premium license.
Excellent. Thank you Shane!
Happy to help. Have a great day. 🐶
Hi Shane. Awesome video, thank you! Do you plan to make one to cover Dataverse security too? Pretty please... :)
It is on my list for sure. I just keep hoping they will update the UI. Security still uses the old tooling. UGH.
This is a great video. I have some thing like a simple suggestion box powerapp that is connected to SharePoint list that list has items on it I do not want visible. I would like to make it where we have two classes of uses normal cannot see or access the list and admins can see the full list. Maybe this is more of a SharePoint Security Video and not a powerapps ones but am in need. Your videos rock! Please keep making them. I am very new to SharePoint/PowerApps and cant spell SQL if you know what I mean.
Try looking at Approvals in SharePoint. Might get you close.
Great video as always Shane! Just wanted to say two things: #1 - super great idea with the new SOP, creating the other environment. #2 - on the Analytics Report (which uses Power BI) when you saw United States, there should be the ability to “drill down” or expand downwards to see the hierarchy, Country, State, City, etc.
Give me a thumbs up if that drill down works for you. Otherwise, keep up the fantastic work!
No drilldown for me either :(
Shane - Thanks for this video! Super helpful when navigating the dilemma of implicitly shared connections. Taking this one step further, if an app is created in a "secure" environment that we spin up and shared with other users who do not have maker privileges in that environment, can they use that app through the PowerApps visual in Power BI? If so, do we need to share the app with all users that also have access to the PowerBI app for them to be able to interact with it?
I haven’t tried before but I think the answer is yes. As long as you share the app with all of the PBI users you should be good
Great video. This covers exactly the security concerns we were having. Now to just get that P2 license...
Great video Shane, thank you :) One question, given that Chewy can't access the PowerApps Secure studio environment, I was wondering if there was a way for him to get a link/url to the app without relying on the e-mail he received?
Not that I know of
Shane you are the best! Love your videos!
Thank you for the kind words
Great video Shane! If you use a P2 license to create your PowerApps application using CDS. Can other users who do not have a P2 license use the app? Same for the environments?
They would need a p1 to access cds
Very good video thanks again Shane, when we add someone to the production environment as app maker that person will be able to edit all apps within the environment? If so how can we setup security based on the app, so only a specific people can edit specific apps? Thanks.
That is default behavior. People can only edit apps they are owner of. But they can use any connection you have shared with them.
Hi Shane, great video and answered what i needed to know about security in SharePoint.
I have PowerApps for O365 licence and was looking for Plan 2 - am I correct in saying that this type of licence is no longer available? Can I achieve what you demo'd in your video with my current licence? Does creating an additional environment with CDS come at an additional cost?
So it would appear that SQL connections as you described is the only way to secure your data. Does that mean that i would need SQL connectivity licence for every employee in my organisation that potentially would like to use any applications we build? I work for local government and need to ensure data is secure but our solutions are not too costly.
Hi Marie. Yes licensing changed. I do think to properly secure your data you will need sql or cds. Both of which requires a premium license
Thanks for a great Video Shane...
Dose changing environment give similar protection to Sharepoint too ?
Nope because you have to grant access to SharePoint directly 😢
Thanks Shane ... it is strange that Microsoft didn’t think if it.
Hi Shane , thanks for great video, my question is if it is possibile add to Enviro Makers also O365 groups instead od individual person.
Hey Shane...looks like an amazing course and excited to learn. Any pointers on- which order should I view ur tutorial to get a deep understanding.I am CRM professional thanks. 🙂
Not really. Learn Powerapps is the first then they go crazy. 😀 we do have proper classes available www.PowerApps911.com/training
Thanks Shane,
I have one question, how can you solve the problem if you use SharePoint as data source? I guess you would have to limit and personalize permissions in SharePoint lists. Is there anything "environments" can do to help manage this?
Hello, First of all, thanks a lot for making those videos. They really help and are really informative.
One quick question at the license level: SQL Connection (as CDS) requires the use of a premium connector. If I get a premium license, I should be able to access those. However, when sharing the app (even in a secure environment) to other users, as I am "implicitly" sharing the SQL connection, does that mean that the app user can use the app?
My understanding is the following: users will be leveraging my connection. Therefore, my assumption is that they should be ok using the app with a basic license (the one that comes out of the box with an office 365 license). Is that correct? Or, do they need to upgrade their licenses?
Thanks in advance for your answer,
Cheers, Leonard
If your app has a premium connector (like sql or cds) then all users of the app have to have a premium license. So in your case everyone needs a premium license
Shane, thanks a lot for another great video. I am relative new to Powerapps. Actually I have two main questions
1) is it possible to assign a more meaningful name for a connection than the standard name Sharepoint without any hint to which web-site it provides the connection?
2) how is it possible with Powerapps and SPO or SQL to deal with concurrent users in a reservation app with a great number but also limited articles, for example parking spaces. Is there any thing like transaction support in SPO which prevent that users overwrite an existing reservation? Do you have any suggestions where I can found further information?
Thanks a lot
Kind regards
Christian
1 nope. 2 you would have to write the logic to avoid conflict. It can be a pain in the butt. 😑
Hi Shane, great explanation, I have two questions (maybe already asked): 1 I have an app in PRO environment, how can move to "secure" environment and viceversa?.
2. There is an option on the top that says "Convert to Production" (you don´t have it in your video -26:57), it will replace the original production and will lost the existing apps?
2 I don't think so. I believe it just converts the environment to be permanent.
Thanks Shane, this is very useful information. Do we have this documented somewhere? Some text I could reference maybe?
I haven’t written it down. Sorry.
Nice explanation shane thanks! I thought envrionments in power apps should work as spaces where we can develop apps and pass it over different environments in order to follow a deployment flow... like and app that was created in a "DevEnvironment", and then pass to "QAEnvironment", then to "StressEnviornment", and finally in a "Production" environment. Is this exists in power apps?
Yes, look into Solutions. They allow you to package up your changes from Dev and move to Prod. Not perfect but close.
Great stuff cheers... Two questions... What if you have an app with some content editors and some content readers. How could you achieve this via security rather than visibility or some other hack?
To limit access to the SharePoint list could you not change the permissions in the SharePoint list. So instead of them being members they become readers?
Yes. As long as they only need read then that is all you have to give them in SharePoint
Hi Shane, great video. Just wanted to confirm security with you. Are you saying that there's no way to secure the Sharepoint list from users as they can access and updated bu going directly to the list ? thanks
That is correct. You can make it harder for them but in the end they must have access.
Great subject to cover, Shane. And to confirm, there is only the need to have one licensed P2 account to generate the environments and manage the environment's security? Thank you.
NOTE: today each PowerApps Plan 2 license only grants you 2 environments to provision, so if you only needed that then that is correct.
HOWEVER, I'm happy to call-out that we are removing the Plan 2 license requirement for admins in the next couple of months as outlined here: powerapps.microsoft.com/blog/provisioning-and-administration-is-getting-easier/.
Thanks again James. :)
@@mitshot60 Does this mean that we will be able to remove the maker role from a user without a Plan 2 license? How do the new provisioning rules affect Plan 1 users? Will they be able to create multiple environments that use Azure SQL Server as the back end?
@@woodmanjon
Q: Does this mean that we will be able to remove the maker role from a user without a Plan 2 license?
A: Correct
Q: How do the new provisioning rules affect Plan 1 users?
A: They would be able to create and manage environments the same as P2 users can today. Not impact to their current capabilities.
Q: Will they be able to create multiple environments that use Azure SQL Server as the back end?
A: Yes, as long as there is available capacity in their organization to create those additional environments
@@mitshot60 that's amazing!! Thank-you!!
Hey Shane. I'm assuming all the things you said about Sharepoint here would apply also to Dataverse?
Martin I want to say yes. But I don't remember everything I said. :)
I have 2 quick questions.
1. What's the difference between Trial and Production environment?
2. In PowerApps is it possible that, one of my app is always be in production. One will be in development.. Whenever development completed it is moved to the production?
RE #1 - The main difference is that a trial environment only lives for 30 days before it is deleted. Production environments are permanent, and require production capacity to create: powerapps.microsoft.com/blog/provisioning-and-administration-is-getting-easier/.
RE #2 - It really depends on how you are structuring your "development app" vs your "production app" and which type of app it is:
1. If you are just building a canvas app - your 'development' app can just be the working draft of the same production app. And when you are ready you can 'publish' it to all of the users who have access: docs.microsoft.com/powerapps/maker/canvas-apps/save-publish-app
2. If you have a more complex app, including model-driven apps against CDS, you could consider creating separate "developer" and "live production" environments. This is important because you will be making metadata changes that can introduces conflicts in the same environment. In this scenario you will need to have an application lifecycle management process using solutions to transport your changes from development and publish to production: powerapps.microsoft.com/blog/alm-at-scale-new-features-and-automation-capabilities/
Thanks James! 👍 In case anyone is wondering these are his features so he is the authority.
Thanks for this Shane, very timely ahead of MBAS, one of our slides we're presenting is specifically on this topic, but I have 1.5mins to cover it vs your 27! Haha
One of my slides also covers it. So that is why I finally bit the bullet and made the video so I can link to it. Be sure to stop and say hello if you get a chance.
Good one Shane! But I was looking for how users can login to Power Apps Canvas apps.?
If I create an App with Username/Pwd , what are the different ways to process User's credentials in a secured way?
If I have users who are not in the PowerApp users list how do we consider their Login mechanism?
Regards
Atanu
Everyone who logs into your app has to have an Azure Active Directory account. That is the only way to log in.
Hi Shane. Does this method still apply in 2022, or is there a new way to approach this issue? Thanks!
Hi Tommy. The license stuff is different. The SQL connection stuff is the same. Though you could also setup your SQL connection to use Azure AD instead of SQL and then that would change some of the challenges.
@@ShanesCows Thanks for the reply, Shane. I've followed the video, created a new environment to isolate the connection from end users, and it works like a charm. Thanks again. You need more subs, this is useful stuff!
Thank You for providing such informative videos. Could you post more videos regarding security. It is a bit different now with admin.powerapps changing to admin.powerplatform. Again, thank you for all the videos you post.
Will add it to my list. 😀
Hi Shane. Following the licence changes a couple of months ago, what are the licence requirements to achieve the set-up you recommend in this video? We are Office365 users so we all have access to Power Apps default environment from that.
Am I right in saying:
To create a new envionment = at least one person will need a 'Power Apps Per User' licence $40/month
To run an app that uses the SQL connector (Premium) = every user will require either a 'Per App' licence $10/month of a 'Per User' licence $40/month.
James I am not 100% but I think unity can create environments without additional licenses now. Not sure. I need to try. SQL is now premium though.
Great video. I have a question. If I share a Sharepoint list with users but I dont send them an invitation email and I dont tell them the name nor the location of the sharepoint list, how they can access it outside the app? Is there on Sharepoint something like "Shared with me" list of docs,lists? Thx.
Shane the illustration used for creating a secondary environment to help with SQL can you apply the same principles using the secondary environment but with a SharePoint list?
SharePoint is a bit different. SharePoint is about permissions to the list.
Nice video, thanks!
I've been thinking about making any SharePoint list to be read only when there is a need to just read the list. And calling a flow with the data that I want written to a SharePoint list when updating data is required. A flow SHPO connector is authenticated inside the flow and there would not be any need to grant write access rights to the power app users.
Obviously this is a bit tedious but wouldn't this work?
If Power Apps triggers the flow then it runs in the context of the user. 😑
Great information. While i don't use sql connections and mainly use SharePoint, the sql info is still interesting. For SharePoint, would setting users up as read only permissions stop those users that have been shared the app the ability to edit the list or library, but still be able to see the data in the PowerApp?
Yes, if you give them access to read SP list, they will not see the data coming from SP to PA but they won't be able to edit the data.
This is what Shane has discussed in this video, if they somehow find your list, they can edit, wipe, download the entire data as they have access to the Sharepoint List.
Unfortunately, same theory goes for Microsoft Flow too if you have lined it with your PowerApps. I am surprised to see Shane didn't mention about it. You will have to make your users Co-Owner of the Flow too (no Run only permission here for PA type), and hence if they find your Flow (which is pretty easy by logging in to Flow website), they can do a lot of damage to the entire process or make it a paralysed Flow! MSFT has a long way to go for this.
Before I was into PowerApps, I used SharePoint Designer Workflows to remove List permissions and set permission on each record itself. I didn't tested it yet, but i suppose that would still be an option. MS Flow should also work of course.
Thanks for the video, as we started using Power Apps with CDS as source. However users who were able to access/update the data from an Entity, suddenly started to get error message.
May i know if you have any suggestion on how to resolve this, thanks in advance
CHeck the Role permissions. My CDS series starts here th-cam.com/video/49O1UW-tkyo/w-d-xo.html
Could you do a video on using Environment Variables that can change code based on which environment you're in?
I haven't used them before but it sounds like something I should look at.
Hello Shane, I am trying to get the screens visible based on security roles .. so I have tried to get my security roles using clearcollect but I am not able to check the screens based on roles
Try this video th-cam.com/video/0MB-z9cyFCQ/w-d-xo.html
excellent !! thanks
You are welcome!
Good Day Shane, this is my first message, but not appreciation for all your contents. My question is: Can we achieve the new environment security with SharePoint Lists? It seems I have P2 License since I have all these features, but when sharing apps with cds backend, they are being requested for a P2 Trial. So I’m stuck with SharePoint Lists.
No you cannot secure SharePoint the same way. Sorry
What's the condition for implicit data source share ; are there a condition for excel sheet to be implicitly shared because I can't have the Share button . IT DOES NOT appears FOR MY SHARED ONE DRIVR EXCEL SHEET
You need to share the file in OneDrive
Hi Shane. Is there a way to logically set the roles of users added to groups in Dynamics 365? I'm a gov employee, we're using Azure to authenticate and powershell to add users to groups but is there a way to assign roles automatically as opposed to manually? we'll be onboarding about 500 users...
Not that I know of Kim but I am far from an expert on Dynamics security so not 100% sure
Hi Shane, I was wondering if there was a way to use an app in a Test Environment without affecting/impacting live data in SharePoint? If that makes sense.
Thanks
YEs but you would have to build test lists and such and then change which ones the app is wired to when you move it.
15:03 great video thanks for the information! excellant pls keep making!
Thanks 😊
I would actually like to, even in the default environment, to only allow users to use but NOT create PowerApps. In that case would it also prevent them from customizing sharepoint forms with powerapps
I think so
Do you have an updated video that covers AD security with a sql connection? For some reason I deleted all of my old implicitly shared connections to an app, and reconnected using AD but its still showing that there is an implicitly shared connection. Not sure why.
I don’t yet. Sorry
Hi Shane, I have a Power Apps Per User Plan and created an environment and app with SQL connector. When I shared an app with E3 users, they were not able to access an app. Can you please explain why users could not access?
You need enough per user plans to cover everyone, not just you.
Is plan 2 you mention the $10 a month or $40 a month plan from Microsoft?
They changed all of the licenses. Now anyone can create an environment but you need to pay for storage
Very useful information..
Glad to help
Shane is their way with code or power automate to password protect document excel and word
Not that I know of. You would have to look to see if there is a Graph API call that does it and then go from there.
Great video. Thanks you !
so, if i have one List in Sharepoint connected at PowerApp, the users always can change the data of the List en Sharepoint without occupying the app? :(
Yes. Sorry.
Hi Shane, is it possible to copy from our default environment to the secure environment.
I think the only option so far is export and import the app.
Correct.
Vishal is correct. I would use Import and Export.
Is posible to do a rol interface for different users in power apps and call a different table in excel por each one of the users ?
Can be done by VB lenguaje ?
Yes I have built multilingual apps like this with if formulas. 😀
So, how many noticed the title of Shane's video has 'Environments' spelled wrong! LOL :)
Whoops. All better. Thanks. 😂
I followed all steps and still having the message "you are using one or more implicitly shared connections"
Correct. It is still shared but the good news is in the second environment they cannot access it to use it. 😀
Environments are useless when you are using On-Premise Data Gateways because you can only access them via the default (corporate) environment. This means I have no test or dev environment because they cannot access my test db.
It isn’t ideal that is for sure.
I have office 365 license of power apps. But still it connects to sqlserver.
Yes, but when you publish the app the users of the published app will need licenses.
@@ShanesCows so developer can develop in Office 365 but license is needed as per his connectors
@@shubhamsatpathy6489 Yes, licensing matter when a user uses the app, not for the developer making it.
@@ShanesCows how to verify the license that has been assigned to the workspace is powerapps/user license. ?