Sharepoint list permissions

[Syndicate_Admin]

Hi,

My organisation has a few PowerApps where the data contained in the data source (Sharepoint Lists) is sensitive information about employees.

We have followed all the guidance so that the lists are not accessible through web browser and have also used a flow to set the hidden and Nocrawl properties to true. The list does not even show up in site contents.

However…

All lists on all sites are accessible through excel and the New Query -> SharePoint List

Yes, you have to know the Site name. But if you do you can see everything and import the data into excel.

Is there any way round this?

Strangely Teams sites are not affected by this. You have to be a team member or have permissions to read/write/contribute something in the site. 

Thanks very much.