{"id":293,"date":"2022-01-18T11:00:59","date_gmt":"2022-01-18T11:00:59","guid":{"rendered":"https:\/\/blog.citrus-lime.com\/crmc\/?p=293"},"modified":"2022-01-18T11:00:59","modified_gmt":"2022-01-18T11:00:59","slug":"synchronising-dynamics-power-apps-security-with-sharepoint","status":"publish","type":"post","link":"https:\/\/blog.citrus-lime.com\/crmc\/synchronising-dynamics-power-apps-security-with-sharepoint\/","title":{"rendered":"Synchronising Dynamics \/ Power Apps Security with SharePoint"},"content":{"rendered":"\n<p>Initially or \u2018out-of-the-box\u2019 the security model in Dynamics and Power Apps has no synchronisation with the security model in SharePoint.<\/p>\n\n\n\n<p>This means that without integration any security rules we configure in Dynamics or Power Apps will need to be manually configured in SharePoint to ensure both systems share the same access levels. (or we run the risk of Documents being available to Users who should not have access to them)<\/p>\n\n\n\n<p>DocDrive solves this problem by integrating security from Dynamics and Power Apps into SharePoint.<\/p>\n\n\n\n<p>At one level this means that we can pass the Users connected with a record in Power Apps into SharePoint so the User or Users with access in Power Apps have their access mirrored with SharePoint:<\/p>\n\n\n\n<p>This is often implemented for the core Owner field in Power Apps as every record in Dynamics or Power Apps typically has an Owner.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_153943C5.png\"><img decoding=\"async\" src=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_thumb_06FACAD5.png\" alt=\"image\" title=\"image\" \/><\/a><\/figure>\n\n\n\n<p>Setting the Owner here in Dynamics will then reflect in SharePoint:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_30719CC6.png\"><img decoding=\"async\" src=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_thumb_3724A649.png\" alt=\"image\" title=\"image\" \/><\/a><\/figure>\n\n\n\n<p>But this approach to the shared security is very User Specific and so can be difficult to govern.<\/p>\n\n\n\n<p>The way we manage this better is by using Teams in Power Apps mirrored with Security Groups in SharePoint.<\/p>\n\n\n\n<p>So if take the same example above but instead of having the record owned by a User, we assign the record to a Team, this then grants everyone in that Team access to the Record in Power Apps and similarly grants everyone in that Team access to the Documents Location in SharePoint.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_0FEA5D14.png\"><img decoding=\"async\" src=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_thumb_768259D9.png\" alt=\"image\" title=\"image\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_1226E5D0.png\"><img decoding=\"async\" src=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_thumb_6AEC9C9A.png\" alt=\"image\" title=\"image\" \/><\/a><\/figure>\n\n\n\n<p>When we then add or remove Users to this Team in Power Apps &#8211; this is immediately synchronized to the Group in SharePoint.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_6D95584B.png\"><img decoding=\"async\" src=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_thumb_1B16780F.png\" alt=\"image\" title=\"image\" \/><\/a><\/figure>\n\n\n\n<p><strong>Our Team in Dynamics \u2013 we can add or remove Members here as we do for any other Team.<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_01AE74D5.png\"><img decoding=\"async\" src=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_thumb_215D4E9D.png\" alt=\"image\" title=\"image\" \/><\/a><\/figure>\n\n\n\n<p><strong>The changes are then immediately available in SharePoint \u2013 and so applied to any of the Sites, Libraries or Folders that are using this Team for their Security<\/strong><\/p>\n\n\n\n<p>This means that any changes to our Teams automatically and immediately grant or remove access to the relevant records and documents &#8211; without having a large volume of User Specific permissions to manage as this can make Joiners and Leavers difficult for governance.&nbsp;<\/p>\n\n\n\n<p>Using the Teams and Groups approach here &#8211; we can simply add or remove users to the Teams and the Team then set their permissions.<\/p>\n\n\n\n<p>Each Business Unit in Power Apps and Dynamics has a default Team that encompasses all the Users in that Business Unit &#8211; and this auto Team can be useful to help set security for that Unit.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_6AEF2D4B.png\"><img decoding=\"async\" src=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_thumb_3F3E634F.png\" alt=\"image\" title=\"image\" \/><\/a><\/figure>\n\n\n\n<p>This is then available to us in SharePoint to see the Documents restricted to Users in that Business Unit + the 2nd Team we have added here via a Custom Field:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_3ED2305A.png\"><img decoding=\"async\" src=\"https:\/\/license.citruslime.com\/cs\/blogs\/crmcs\/image_thumb_5A76BC50.png\" alt=\"image\" title=\"image\" \/><\/a><\/figure>\n\n\n\n<p>As users will be automatically added and removed from the Business Unit Team as they are added or removed from the Business Unit \u2013 this can be a quick and easy way of ensuring both systems security is kept in synch.<\/p>\n\n\n\n<p>Particularly as we can setup Workflow in Dynamics \/ Power Apps to automatically tag each Record owned by a User as being available to all the other Users in the same Business Unit as a simple \u2018I can access information in my Business Unit but not others\u2019 security model.<\/p>\n\n\n\n<p>When combined with other potential Access Teams \u2013 this can start constructing a Business Unit Security Model that is applied to both Dynamics and SharePoint consistently, plus, give us a method for allowing confidential access or super users to access Records and Documents across different Business Units if we have a layer of high-access or super users.<\/p>\n\n\n\n<p>This area of joining up Dynamics and SharePoint security is a key feature of DocDrive and we can take a deeper look at how this is done in the next article in this series here:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/www.crmcs.co.uk\/docdrive365\/docdrive365-articles\/content\/docdrive365-security-day-one-getting-started-with-dynamics-to-sharepoint-permissions.aspx\" target=\"_blank\" rel=\"noreferrer noopener\">DocDrive365 Security: Day One &#8211; Getting Started with Dynamics to SharePoint Permissions<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"<p>Initially or \u2018out-of-the-box\u2019 the security model in Dynamics and Power Apps has no synchronisation with the security model in SharePoint. This means that without integration any security rules we configure in Dynamics or Power Apps will need to be manually configured in SharePoint to ensure both systems share the same access levels. (or we run<\/p>\n","protected":false},"author":43,"featured_media":88,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_price":"","_stock":"","_tribe_ticket_header":"","_tribe_default_ticket_provider":"","_tribe_ticket_capacity":"0","_ticket_start_date":"","_ticket_end_date":"","_tribe_ticket_show_description":"","_tribe_ticket_show_not_going":false,"_tribe_ticket_use_global_stock":"","_tribe_ticket_global_stock_level":"","_global_stock_mode":"","_global_stock_cap":"","_tribe_rsvp_for_event":"","_tribe_ticket_going_count":"","_tribe_ticket_not_going_count":"","_tribe_tickets_list":"[]","_tribe_ticket_has_attendee_info_fields":false,"footnotes":""},"categories":[4],"tags":[],"class_list":{"0":"post-293","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-docdrive365"},"featured_image_src":"https:\/\/blog.citrus-lime.com\/crmc\/wp-content\/uploads\/sites\/30\/2021\/12\/DocDriveSiteimageclouds-scaled.jpg","author_info":{"display_name":"jadesmith","author_link":"https:\/\/blog.citrus-lime.com\/crmc\/author\/jadesmith\/"},"_links":{"self":[{"href":"https:\/\/blog.citrus-lime.com\/crmc\/wp-json\/wp\/v2\/posts\/293","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.citrus-lime.com\/crmc\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.citrus-lime.com\/crmc\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.citrus-lime.com\/crmc\/wp-json\/wp\/v2\/users\/43"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.citrus-lime.com\/crmc\/wp-json\/wp\/v2\/comments?post=293"}],"version-history":[{"count":1,"href":"https:\/\/blog.citrus-lime.com\/crmc\/wp-json\/wp\/v2\/posts\/293\/revisions"}],"predecessor-version":[{"id":294,"href":"https:\/\/blog.citrus-lime.com\/crmc\/wp-json\/wp\/v2\/posts\/293\/revisions\/294"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.citrus-lime.com\/crmc\/wp-json\/wp\/v2\/media\/88"}],"wp:attachment":[{"href":"https:\/\/blog.citrus-lime.com\/crmc\/wp-json\/wp\/v2\/media?parent=293"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.citrus-lime.com\/crmc\/wp-json\/wp\/v2\/categories?post=293"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.citrus-lime.com\/crmc\/wp-json\/wp\/v2\/tags?post=293"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}