Hi
@Joana Mira,
With my colleagues, we also wondered about this and we came up with some of the ideas you already mention in you post:
- hiding the list
- restricting access only to records that belong to the user
But there is one thing we though we could do also... Firstly, we considered that if the user accessed its own data in the list through SharePoint in "read mode" it is harmless. But to prevent the user from creating or editing items directly through the SharePoint list (which could lead to incorrect data, eventually also in other lists, thanks to business rules handled only by the Power Apps application), we though of customizing the SharePoint list's form with Power Apps and hide the form control to show a label saying something like: "
Editing your data through the SharePoint list is forbidden. Please access you data through the application NAME_OF_APPLICATION : <url>".
Now, about the fact that PowerBI Desktop would not apply SharePoint's permission when accessing the list and thus let a user retrieve all records from the list, I mus say I am really suprised. I suppose PowerBI Desktop uses API to acces data and thus permissions should apply. Have you found any article or idea or bug report about this? I haven't done any search on this on my side yet but I'll look into it in the coming weeks.
Hope this helps,
Emmanuel
------------------------------
Emmanuel GALLIS
Office 365 Consultant
Ai3
TOULOUSE
------------------------------
Original Message:
Sent: Dec 19, 2019 11:05 AM
From: Joana Mira
Subject: How to Restrict Access to Sharepoint Lists?
Hi everyone,
What is the best way to restrict access to a SharePoint List by users?
We are implementing a solution with PowerApps internally to control all the employee's expenses.
This solution is currently connected to a SharePoint List. We have hidden the list in the SharePoint Site and restricted the visibility of the records so that the users can only see their own records in case they are able to find this list.
However, if a user connects to the SharePoint Site using PowerBI Desktop these same permissions do not apply, and they are able to extract the information for all the records in the List.
Is there any way to restrict this?
We thought a solution could be to hide the list in a subsite. Nevertheless, I was wondering if there is a best practice for sensitive information when using SharePoint Lists.
Thank you!!