SharePoint Security in Power Apps | Item Level & Folder Permissions

[@juansepowerplatform]

Wow, this is more like true security. All other work around solutions were just not that feasible. I always had an issue with providing security around PowerApps but a knowledgeable user could go around to SP and by pass that security. This solves that issue. Thank you!

[@RezaDorrani]

Thank You. Yes, this is true security. No user can hack the backend with this.

[@side54723]

There is no point setting your videos as favorites in my playlists. I just have to go to your channel content ! Everything could be set as favorite !

[@RezaDorrani]

Wow! Has to be one of the best compliments I have received. Thank You.

[@brendan1516]

WOW! I thought I needed a SQL Server to set up true security filters. I had no idea that the Gallery control will pull all items from each folder. What a simple, elegant solutions. Now I may continue to develop security sensitive Power Apps that don't need Premium Connectors and have no additional cost! Thank you for this video!

[@RezaDorrani]

You are most welcome. This video did not get much love may be because of the title or the use of folders. But this indeed is true security in SharePoint.

[@jt9228]

You saved me again! I became a sub a while back when I first started learning Power Apps. Today I was searching for how Power Apps can work with folders in a list; your video came up. Excellent information; thank you!

[@RezaDorrani]

Glad to hear the video is useful! Thanks for watching.

[@JPrado]

Thanks Reza, I have a large list where I use flow to break and assign permissions for some items, didn't know about the 5000 limit, this solution is awesome! You rock dude.

[@RezaDorrani]

Thank you

[@VeetleViewer]

Reza, this is a very elegant solution. Variations of this use case exists in every department of every company. Thank you for sharing with the community! :)

[@RezaDorrani]

Thank you. I agree, this is something that can be used in so many scenarios. This will work in case of large lists & libraries and avoid having users to break permissions on every item.

[@Worrelpa]

Total gold.... someth9ng so simple yet genius. I know discussion board in SP work with list with folders. The folder is the discussion and the items in the folder are the discussions replies. So interesting that Powerapps just reads the list and folders without any that special to do to them. You just solved a lot of issues people have with using lists as a data source.

[@RezaDorrani]

Thank you Phil. All of your points are spot on. Finally a good use case for folders.

[@georgewahtaplah6128]

Thanks Reza, this is classic! This solves an overbearing headache for me. Permit me to add this to my project. Thanks for your relentless commitment to save the world from itself. Kudos!

[@RezaDorrani]

Thank You :) Feel free to use this in your project scenarios.

[@Udaan_Akash_Ki]

Hi George, I have one doubt at 15:50 Reza copy pasted one formula in that for creating varResult he used the "Set" but for varFormMode he hasn't used anything so I am getting error in my case when I entered the formula in same way as he did. Please tell me how to fix the issue? varFormMode is giving error

[@antonnyrkov1905]

Hey, Riza. Thank you a lot. This is a great solution. Just what I was looking for one of my projects. Your video saved me from a headache.

[@RezaDorrani]

You are welcome 😊

[@md.fazlulkarim]

I am starting to follow your videos! Excellent presentation and like the zoom feature. I can now think of projects that I can possibly implement. Again awesome stuff.

[@RezaDorrani]

Thank you for watching

[@szalaizsol]

Hello Reza, That is a really great video. Thank you for this

[@RezaDorrani]

I'm glad you like it

[@chadalthaus3866]

The collection of folder paths rendered as a drop-down is SO clever. I was curious how you'd solve the issue of knowing which folder to move to.

[@RezaDorrani]

Thank you 😊 I was wondering about how to get the folders one has access to and came across that technique. Im using it in one of my projects currently.

[@ppei2012]

Thank you, Reza! What a genius solution!

[@RezaDorrani]

Thanks. I feel this solution opens up so many possibilities.

[@andreaschunzel4672]

Well explained, Reza, thank you very much!

[@RezaDorrani]

My pleasure!

[@jamesclark2020]

Brilliant video. Such good instructions.

[@RezaDorrani]

Many thanks!

[@ericvanderknaap835]

Hi Reza, thank you so much for this video. It was exactly what I was looking for. I was thinking, when working with a power apps custom form, the root-level problem would not apply. When I add an item from within a folder in my list, the item will be saved to that same folder automatically. The avantage would be that I don' t need the additional flow in that case. Still have to try, but I'd think it would work that way.

[@RezaDorrani]

Thanks for watching. Your idea sounds right.

[@brendan1516]

I just had a thought to add here. I am going to attempt this strategy for what should become a very large data set. For gallery view where we only want to see the folders, you use the flexible height gallery and hide any items that are not folders. My concern would be if I have several thousand records that the hiding is done in the App and it will still need to load all the records to the device prior to determining what to hide or not. To prepare for my potentially large dataset this is what I did. I created a Yes/No column (default is No) in order to tag the folders as a folder (Yes). In this case I labeled it 'isFolder' to distinguish from 'IsFolder'. Now for the gallery I am able to put a filter on the dataset and don't require a flexible height gallery. This way I delegate the filtering to the server and my App only loads the folders to begin with! Now if I have tens of thousands of items in the future, I should maintain good performance for the local users. Filter(LargeSharePointDataSet, isFolder) I am pretty happy with this add, what do you think?

[@RezaDorrani]

This video showcases true security as the users will only see those folders where they have access. Several thousand files is not an issue. But if there are 1000s of folders that a user has access to then there could be a case for handling it with a column filter. I actually showed that in a separate video - kzbin.info/www/bejne/ip61d3SGbN2Hrc0 The Yes/No column has a known bug with Power Apps and I would recommend to instead use a Choice column with values Yes/No.

[@brendan1516]

@@RezaDorrani I was thinking of several thousand items, even if there are only a handful of folders. Trying to prevent the load but don’t show when Viewing the filter list. And thanks for the tip on the choice. I did notice the logic was a little weird.

[@RezaDorrani]

@@brendan1516 Gallery will still do optimized loading in case of several thousand items. You can check the Monitor tool in Power Apps to confirm.

[@daniellebresich8074]

Hi Reza, great video as always. Can you explain more of of the varFormMode and varResult fields in the OnSuccess function of the form? I'm sure that I need to set something in the Form equal to varFormMode but not sure where to do that. Also could use some clarification surrounding varResult and where that comes into play. Thank you!

[@RezaDorrani]

varResult is to check the response of the flow. Download link of flow is in video description. To learn more about form modes - kzbin.info/www/bejne/l4eokoWmdtGUiqM

[@SihamHassen-e2k]

As always great resource from a great trainer, @RezaDorrani I have a Question please if you can explain on How you managed to change the file paths on the dropdown from Lists/Project Request Management/Europe ...... to Europe - IT, Europe - Finance and the like..... you kind of mentioned it at 26:39 in the video but you did not show how that is done. If you can please shade some light on it?

[@RezaDorrani]

Thanks! Oh wow, this was done over 2 years ago. No chance I remember this. I may have shown this in some of my other videos. Im sorry but thats the best response I can give.

[@SihamHassen-e2k]

@@RezaDorrani Thank you so much, I will dig in to it! I appreciate your prompt response.

[@limkengseong99]

That’s amazing 🤩. I am curious on the Send HTTP action in the Power Automate. Instead of Move the folder from One SP Library to another, is there anyway to Break the Inheritance (Stop Sharing the one specific Folder access in the SharePoint) with the Send HTTP action in Power Automate? Thank you 🙏

[@RezaDorrani]

Thanks for watching and liking the video. You can use the SharePoint rest api actions for breaking role inheritance on item/folder/file. I do not have a specific video on this scenario. I will recommend checking on the forums at powerusers.microsoft.com/

[@goodguywins]

This is so helpful, thank you again! I have a question about the combo box - how did you get it to display the folder name (or the 2 folder names)? You skimmed over it, so I thought it would be easy - but I can't seem to figure it out.

[@RezaDorrani]

In every folder just add an item with a unique title like "Template" as I did in the video. Then you can easily query to get all items which have "Template" in the title. Only those items will be returned where users have access. You can then grab the folder path of those items to get the "Folders" the user has access to. Watch video from this point onwards kzbin.info/www/bejne/h6Cxgp2sfdBpp8U

[@tetsuyakawahara4150]

Amazing😆✨

[@RezaDorrani]

Thank You!

[@Figanomics]

Thanks Reza this is really helpful. Question RE folder selection. My list items are set up as /lists/rootname/DATACARDVALUE1_DATACARDVALUE2_DATACARDVALUE3. How would I go about defining this in the OnSuccess formula when running the flow. Basically, it’s DC1 is their name, DC2 their role and DC3 their team so it’s important that I can move their list items to their own folders.

[@RezaDorrani]

I will have to look at your App in action to provide guidance. I would recommend posting your issue/query with screenshots on the forums at powerusers.microsoft.com

[@ThuyDoanchung]

Hi Reza, it is amazing video, helped me a lot. Thank you so much. I have an issue, after manage access for a SharePoint group on Folder, users on that Group can not submit new record even on the root of the list. They can only update the current record on the folder. If I give them the right on the root list, they can submit new record.

[@RezaDorrani]

You will need to give access on root list. Since Power Apps can only create items at root. Another option would be to create a separate list where users have access to create and then move those items to a different list with root level security.

[@FoxiestOfTheHounds]

Great vid, helped me a lot. Maybe you can help a bit with folder security? Our setting is almost the same, employees are only allowed to see their own entries in the respective site folder, except for team lead, they are allowed to see every entry but also limited to their own site. And then we have the cherry on top, which is a few users who are allowed to see all entries of all sites. The problem is, that even when I grant access to the team lead to the folder to view all items(full control for testing purposes) they can only see their own items. Everything else seems to work. Any idea?

[@RezaDorrani]

No idea. I will have to look at your scenario in action to provide guidance. I would recommend posting your issue/query with screenshots on the forums at powerusers.microsoft.com

[@santoshdwivedi726]

Hi Deus, There is a setting in the List setting to show all items in the list or just items created by the user. You can check this setting for your case. Just a wild guess.

[@FoxiestOfTheHounds]

@@santoshdwivedi726 Hi, thanks for your reply. Yes that setting is activated and works. My problem was that even people who were granted "full access" only saw their own entries. Tunred out I had to give them "full access" on the root as well. Which I find weird, but didn't find any other solution so far. "full access" is not really full access, they got special permission to overwrite list behaviour, which allows them to see other items as well.

[@jdhohmann638]

Hi Reza, Thanks for the video. Is it possible to have PowerApps create the folder and assign permissions for it, rather than manually make these folders? I am thinking of a scenario where I want the user to enter records that are stored in an automatically created folder (with the User's name for example) so that only the user (and other users nominated by the user) can see/edit those records? Thanks for all the great info in your videos!

[@RezaDorrani]

Possible. Power Apps can call flow to create the folders. I would recommend to not create a folder for every user scenario. SharePoint item level permissions cause performance degradation after 2000 items or so.

[@RahulPatil-gi1hl]

Hi Reza, first of all thanks a ton for this video! Actually, I'm curious if we can use a table instead of a gallery here?

[@RezaDorrani]

Welcome! Should be possible but not something I have tried

[@Udaan_Akash_Ki]

Hi Reza, thanks for amazing video. I have one doubt at 15:50 you copy pasted one formula in that for creating varResult you used the "Set" but for varFormMode you haven't used anything so I am getting error in my case when I entered the formula in same way as you did. Please tell me how to fix the issue? varFormMode is giving error

[@RezaDorrani]

Im not sure what could the reason be. Check default form mode (what was set in video)

[@Udaan_Akash_Ki]

@@RezaDorrani Hi dear. In "MoveItemtofolderRun" formula I am getting error that invalid no of arguments , 2 received, 4 expected. Can you please tell what went wrong in my case?

[@RezaDorrani]

@@Udaan_Akash_Ki Seems in your case the flow is expecting 4 params. I recommend posting your issue with screenshots on the forums at powerusers.microsoft.com Alternatively, video description has link to download sample flow.

[@cmarkbernal]

This was very informative!! Is it possible for you to do a video on how to setup a gallery and form on the same screen, like in your demo. When you click on gallery item, it fills in the form on the right? I have done this with a lot of effort but I think it's not correct. It runs, but I have a feeling it's going to break lol. If you have a video of this already let me know. I did watch your gallery formatting video but it goes to another screen when items clicked on from gallery. I've read many blogs that said to set the form to gallery.selected but this did not work for me. I did use a custom blank gallery, I'm thinking that may be why. I dunno. I was up till 2am trying to get my one screen to do what I want. Also if you have a video on default gallery sorting, I'd like to see that too. Thanks in advance.

[@RezaDorrani]

I will add the video request for “Gallery and form on single screen” to my backlog. Default sorting is just like normal sorting of data. Check kzbin.info/www/bejne/bHzPemSfj8R-epI

[@cmarkbernal]

@@RezaDorrani This was exactly what I needed to understand sorting and filtering my gallery better. Boooo about the complex columns like Choice lol. Thank you so much for replying.

[@ryanbond8022]

Hi Reza, this is awesome and I'm putting this into use right now. Instead of hiding the folders by using the visible property for the gallery fields, it seems to be possible to put a filter onto the gallery items like so: Filter(DataSource, !IsFolder,....). It seems to be working. Am I missing some reason this is not a good way to do this?

[@RezaDorrani]

The filter against the isFolder property is not a delegable function. Hence, will not work will lists/libraries of more than 500 or 2000 records depending upon the delegation limit.

[@sundrapillay6668]

Thanks Reza

[@RezaDorrani]

Thank you for watching Sundra

[@geralddahl9159]

Thx for this thorough video! Question: Can Power Apps or Power Automate create a folder and also assign the requisite security configurations on an item by item basis? Each record in a Dataverse table I have has an auto number. When I attach files (via Flow to SharePoint) for that Dataverse record I want a folder to be created in SharePoint that has the same name as the Dataverse auto number and then I want the attached file to be moved into that newly created SharePoint folder. I will be the only user so security isn’t really my concern. If such a use case is feasible, would it be better to store the items in a SharePoint document library or list? Thank you.

[@RezaDorrani]

Possible - Yes How - I would have to try it out to provide any guidance I will recommend you post your query on the forums at powerusers.microsoft.com

[@navneetchalagalla1036]

@Reza this is a great video. I am watching your videos to try implement something at my office. My query is, I don't want my users to be able to edit the form or data once already submitted to the list. In my use cases users need to submit fuel consumption numbers etc that should not be changed once submitted. So the existing list item can be viewed but cannot be edited. Same time user should be able add a new item to the list. How can I do this? Watched your editable table as well. Similarly, in documents as well, the user need to be able to upload new document or view an old document. But, should not be able to delete an old document. How can we implement this type of security ? Thank you!

[@RezaDorrani]

You could use the folder concept as shown in video. Users add items to list. Once added, flow moves it to a folder where user only has read access so they cannot make modifications.

[@someone-xt9ef]

@@RezaDorrani I have a similar issue. I have 16 departments (so 16 folders). The problem is a user should not be able to edit/delete items from the list once submitted, but should be able to view it. At the root of the list I can give them Add Item permission to all 16 groups (cannot give contribute or edit permission or users can make changes to the folder itself). For the folders I can give Add Item or Read Item permission similar to above but only for a specific group relevant to that folder. The problem is, using your solution, when they try to create an item in PA, the flow would send failure message because while the item is created at the root of the SP list, users do not have permission to move items to a folder. I think your video is pure gold and would work for most scenarios. Unfortunately does not work for mine or I am not understanding permission levels in SP correctly. I did try your solution in one of my lists, and while it works for me (admin access) it does not work for another user who has permissions set up as mentioned above. Thanks for all your videos, you have taught me a lot.

[@RezaDorrani]

@@someone-xt9ef You can call a child flow from a flow. The child flow can run under admin context. There are ways around it. You would have to explore more.

[@santoshdwivedi726]

Hey Reza, Great Idea. But not working for me. I stopped inheriting permissions and setup unique permission on the folders but still users not on folder permission list are able to see items from all folders. Any clue?

[@santoshdwivedi726]

Reza, I found out solution for this issue. Please see my other comment. Thanks! a lot as always. I learn a lot from your videos. You are truly a gem.

[@RezaDorrani]

Looks like you got it to work based on your 2nd comment :)

[@RezaDorrani]

Nice 👍

[@akashchauthmal8559]

Thanks Reza for this amazing video. I followed your steps but when I changed the visible property then it created a blank space in gallery (folders are hidden but the place they were is still there). Can you please tell how to remove that hidden folder occupied space so we can have better view.

[@RezaDorrani]

This video was done long ago :) Try using flexible height gallery. If all controls within gallery have height set to 0 or visible false, I think it won’t show that blank space.

[@akashchauthmal8559]

@@RezaDorrani thanks reza for your quick response. I have imported the flow in my power automate but I am new to power automate. Can you please tell me after importing your zip in power automate, how to run it using powerapps? On success part u wrote some variables, I did same but it's not working maybe because I didn't run flow so please help me. From 15:30 mins onwards my confusion started.

[@RezaDorrani]

@@akashchauthmal8559 I cannot explain it here on chat. Its a process as shown in video. I have done multiple videos on calling flows from power apps. Alternatively, you can also post issues with screenshots on forums at powerusers.microsoft.com

[@petrinnn]

Reza, thanks one more time for this video. About the columns, is there any way to choose wicth column the users can see? In this video you show us how to choose each group of items.. but in some cases i need to choose columns else..

[@RezaDorrani]

SharePoint does not have column level security. You can show specific columns in Power Apps to the user but the user will always be able to see all columns in the backend list item if they have the access to the list item.

[@petrinnn]

@@RezaDorrani You know if this topic (sharepoint list security) is on the road map in Microsoft?

[@RezaDorrani]

@@petrinnn SharePoint does not have any column security in their roadmap.

[@karukarthi2609]

Please post about Document Set security model with power apps and create a canvas app to show all the document set details with export data option. Very limited articles available on internet regards to Document Set in sharepoint modern site..

[@RezaDorrani]

Limited articles because not many use them. I will add this to my backlog but will need a lot more requests from users for me to start working on this concept.

[@daniellebresich8074]

Hi Reza, do you have another video that shows us how you manipulate the text to just show the folder name in your dropdown called drpDivison? Looking to implement this solution in my app but don't want to display the folder path in the dropdown.

[@RezaDorrani]

I do not have another video on that part. All you need to do is use some string manipulation functions to get the folder name from the path. I will recommend you check on the forums at powerusers.microsoft.com/

[@overtheworl]

Hey Reza, isn't the path you supply via the PowerApp unchecked? a malicious user could intercept and change the value of the template URL. Your flow would still move the item.

[@RezaDorrani]

The flow is triggered from Power Apps, hence the flow will run under context of user running the App. If malicious user (internal to your organization, since Power Apps Canvas works only for internal users) manipulates the URL somehow (not that easy to do), the flow will fail if user tries to move it to a folder they do not have access to since flow would run under their account.

[@overtheworl]

@@RezaDorrani Many thanks for clarifying!

[@RahulPatil-gi1hl]

Hi Reza, where have you defined the variable "varFormMode" ? When I'm replicating this it is giving me error Name is not valid 'varFormMode' isnt recognized.

[@RezaDorrani]

When new button is clicked or when gallery item is selected

[@akashchauthmal8559]

Hi Reza would like to know whats the relevance of varFormMode? As in my case default property of a form is "Edit" only. Does it makes any difference? If so I would like to know how and where you created this varFormMode. Thanks

[@RezaDorrani]

Varformmode drives mode of form. Default is edit. So if only resetform is executed, form will go to default mode.

[@Sabilainaa]

How to create VafFormmode and result?

[@lindadowdell4311]

I am having problems copying provided flow. I get a zipped file which I opened already. Then what?

[@RezaDorrani]

You have to import the zip file in flow. There is an option to import flow.

[@radosawciszewski4932]

Hi Reza, Can't find the 3 ellipses on sharing folder option. Is there another way to access the folder permission settings?

[@radosawciszewski4932]

I have found the answer as soon as I posted the message ;) It appeared when I clicked on one of the group near "Shared with:"

[@RezaDorrani]

Click near "Shared with" - looks like you got it to work :)

[@LachyHughes]

Wonder if there is a way to replicate this application but base the folder structure on users' AAD line managers, so that line managers would see items created by all their team (recursively to the leaf users) - if that makes sense?

[@RezaDorrani]

Hierarchical security is not supported in SharePoint and would not apply to the folder security concept. Dataverse supports Hierarchical security.

[@RahulPatil-gi1hl]

Hi Reza, I have imported your flow. However, it is giving me an error as " 'Run' is an unknown or unsupported function in namespace 'MoveItemtoFolder' " Not able to understand what the problem is.

[@RezaDorrani]

i have not experienced the mentioned issue and hence not sure what the cause for it could be. I will recommend posting your issue on forums in case someone has experienced something similar powerusers.microsoft.com

[@RahulPatil-gi1hl]

@@RezaDorrani I figured this out. I just reconnected the flow to the app and the error got solved. Thanks!

[@raajbir123]

Great tutorial as always Reza. Unfortunately, I get this message when I am trying this method. Access denied. You do not have permission to perform this action or access this resource. But I am able to move the file manually in SharePoint but not via flow. Would you know if I have enable something so I could do this from flow?

[@raajbir123]

And I am the admin of this SP site.

[@RezaDorrani]

Not sure. Must be some permission issue. I would recommend to create a new site collection and test it there.

[@christopherspaulding5188]

Hi Reza, Can you provide me access to the app link? I'm a Silver, but was added after the 90 days.

[@RezaDorrani]

This app was built years ago (when memberships did not exist) If any app has link shared, the description of video will call it out.

[@RahulPatil-gi1hl]

Hi Reza, how did you hide the template line items in the gallery ? I'm unable to filter it out.

[@RezaDorrani]

What is template line item?

[@RahulPatil-gi1hl]

@@RezaDorrani The template which you created in the SharePoint list for getting the folder path

[@RezaDorrani]

@@RahulPatil-gi1hl What time in video is this shown? You question says hide template in gallery. Im confused

[@RahulPatil-mh4qc]

@RezaDorrani timing is 20:51 where you have created an item in the list named template. In the PowerApps gallery I'm unable to filter out those template items.

[@RezaDorrani]

@@RahulPatil-mh4qc did you add template items in SharePoint? If yes, try closing and re-editing power app and check if you get the filtered items

[@santoshdwivedi726]

Has anyone seen this idea into action? In my case it is not working and all users are able to see records in all the folders bypassing folder level unique access granted.

[@santoshdwivedi726]

I apparently, found that some users were among the SharePoint site owners. We can't exclude the Site owner group(created by system), while providing unique permission to folders, whereas we can exclude groups created by us. Just thought sharing with all

[@RezaDorrani]

Looks like your users are Site Owners :)

[@RezaDorrani]

:)

[@miraclesurvivor]

Hi Reza, currently I encountered throttle block when i use SharePoint (Throttle.htm#2057), saying: Do you know how to fix this issue? and why trigger this issue?

[@miraclesurvivor]

Saying "Something's not right The page you requested is temporarily unavailable. we apologize for the inconvenience, please check back in a few minutes."

[@RezaDorrani]

Seems to be some throttling issues on your tenant. I would recommend you post your issue/query with screenshots on the forums at powerusers.microsoft.com