dataverse security custom security roles

[chahineatallah1]

Hi Everyone

So as am preparing for PL-200, I have some questions:

 I created a custom role security called it for example "scout", this role based security will have access only to scout table,  i assigned a user A to this security role

Question1:

so first am not able to see other than default environment although my table scout is in "ca" environment

please note that in my environment i added the user A, but still user A cant see other than default environment why?

Question 2:

Even though i assigned USER A to scout i cannot see any tables at all

so why is that? should i use also the builting security role like environment maker? and why i cant use only my custom security role

[dpoggemann · Accepted solution]

Hi @chahineatallah1 ,

Did you create a model app for the user?  You should be able to provide the user the direct url to the model app.  Also, you would want to add the role "App Opener" to the user as well.

They will be able to see the table in the Model App you assign to the user...

[chahineatallah1]

I was just trying the security,

But why if the user enters into powerapps portal he cant see the environment , but only the default one

Also the tables that this user is permitted to see also not seen, is it obligatory to share an app in order for security to work?

These are my security roles, the user can see only 2 tables

[dpoggemann · Accepted solution]

Hi @chahineatallah1 ,

He will not see the environment unless he has System Customizer or System Administrator type privilege in that environment.  Another option is to assign the user to the Environment Maker role and your custom role but this provides additional functionality you would not want this user to have...  https://learn.microsoft.com/en-us/power-platform/admin/environments-overview#environment-permissions 

Overall the best thing to do here in my opinion is to create a model-driven app with just that table and provide the user the link to verify security permissions...

[chahineatallah1]

yes i tried combination of environment maker and scout security roles, now the user can only access data in tables that are permitted to him in scout security roles

How to make it so that the user cannot see other tables (even the name of table as now if he enters into table he cannot see the data)? my scout role is only enabled for 2 tables as i showed above

[dpoggemann]

Hi @chahineatallah1 ,

I know of no way to restrict this type of functionality to show the listing of the tables that exist.  

[chahineatallah1]

Hi, actually i did as you wrote at first, create app and share it with specific users who have basic role, finally user needs to only access data in the app

[dpoggemann]

Hi @chahineatallah1 ,

If they use Advanced Find they will still be able to see the listing of tables although no access to the records within.