What is Security in PowerApps Canvas App?
Security in PowerApps Canvas App refers to the methods and best practices used to control access to the app, restrict data visibility, and ensure only authorized users can perform specific actions or view certain information.
Unlike some platforms where security is built into the app automatically, Canvas Apps rely on how you design and connect your app to data sources—so you, the app maker, are responsible for enforcing security rules.
Why Security is Important in Canvas Apps?
- Prevent unauthorized access to sensitive data
- Ensure users only see or update records relevant to them
- Avoid data leaks or accidental data modifications
- Comply with business policies and data protection laws
Types of Security in PowerApps Canvas Apps
App-Level Security
Controls who can Access Canvas App.
Â
Implementation:
Share the app only with authorized users/groups.
Use Azure Active Directory (AAD) groups for easier management.
Assign roles like User or Co-owner
Â
Data Source-Level Security
Controls who can access data in the connected data source, like SharePoint, Dataverse, SQL Server, etc.
Â
Implementation:
Dataverse: Use table permissions, security roles, field-level security and row-level security.
SharePoint: Use item-level permissions, site-level access control, or SharePoint groups.
SQL Server: Use SQL authentication or AAD-based security.
Row-Level Security (RLS)
Controls which rows of data a user can view or modify.
Â
Implementation:
Dataverse: Use ownership-based security roles or teams to allow access to only owned/assigned records.
SharePoint: Use item-level permissions or filter data based on the
Created Bycolumn.In PowerApps: Filter data manually using
User().Email.
Field-Level Security
Controls which columns/fields a user can see or edit.
Â
Implementation:
Dataverse: Enable field-level security and assign permissions via profiles.
Role-Based Security
Show/hide controls or pages in the app depending on user’s role.
Â
Implementation:
Maintain a table “Security Roles” (e.g., SharePoint List, Excel, Dataverse Table) with users and roles.
Use this to check role on app start and adjust visibility.
Set(
CurrentUserRole,
LookUp(Roles, UserEmail = User().Email, Role)
)
If(CurrentUserRole = "Manager", true, false)
- We can also apply Role-Based security using AAD Groups (Azure Active Directory Groups)
Environment & Tenant-Level Security
Prevent users from accessing apps or resources from unauthorized environments.
Â
Implementation:
Use Data Loss Prevention (DLP) policies in Power Platform Admin Center.
Restrict connectors and cross-environment access.
Control environment creation via governance policies.
