Forum Discussion
SSO Not Working for Dataverse Datasource
djskro Adding/removing from the Power Apps interface doesn't have an impact on the security of the table at the dataverse layer. - Dataverse Security Roles (and in some cases, shares or inheritance) are the determining factor as to whether a user can view a row of data in a table.
Look at the security role(s) that the user has been granted - and within those roles, ensure the user has no 'read' permissions for the table. - (The dataverse security roles are additive, so if they have 20 roles and only one gives them organizational 'read' permissions - then they'll have read permission for the data in the table, it doesn't matter what the other roles have.)
Also, be sure to check to see if the user is a member of a team where a security role has granted them permission to read the table.
A really helpful tool for troubleshooting/understanding the security of a specific user on a specific record in Dataverse is the XrmToolBox "Access Checker" - Also, the "Privileges Discovery" tool in XrmToolBox will be useful.
(I don't think the lack of 'read' pemission on a table will block them from seeing that a table exists, but it should block the table from returning any data. )
Thank you for this, Scott.
Going through these, what should we do if, in SSMS, logged in as a new test-account, we can, indeed, see and query the tables we do not want the test-account to be able to access (perhaps explaining our results in the Power BI report)?
How do we reconcile the screenshots below of the Power Apps interface with what is clearly visible to the user in SSMS?
djskro Adding/removing from the Power Apps interface doesn't have an impact on the security of the table at the dataverse layer. - Dataverse Security Roles (and in some cases, shares or inheritance) are the determining factor as to whether a user can view a row of data in a table.
Look at the security role(s) that the user has been granted - and within those roles, ensure the user has no 'read' permissions for the table. - (The dataverse security roles are additive, so if they have 20 roles and only one gives them organizational 'read' permissions - then they'll have read permission for the data in the table, it doesn't matter what the other roles have.)
Also, be sure to check to see if the user is a member of a team where a security role has granted them permission to read the table.
A really helpful tool for troubleshooting/understanding the security of a specific user on a specific record in Dataverse is the XrmToolBox "Access Checker" - Also, the "Privileges Discovery" tool in XrmToolBox will be useful.
(I don't think the lack of 'read' pemission on a table will block them from seeing that a table exists, but it should block the table from returning any data. )
Thank you, Scott. This is helpful info.