#PowerPlatformTip 110: 'Protect SharePoint Data'

TL;DR: Copy the Contribute permission level, remove View Application Pages and give it to the app’s users. They keep reading and writing data through your Power App, but can’t open the list’s views and forms in SharePoint. This steers users into the app. It is not a security boundary: the users still have item permissions and can reach the data through other clients that use the SharePoint API.

💡 Challenge

Users should work with a SharePoint list only through your Power App, where validation and business logic live. If they open the list in the browser, they can edit items in grid view, bypass required logic or delete rows by accident.

✅ Solution

Create a custom SharePoint permission level without View Application Pages. This permission covers viewing documents and views in a list or library, so without it the list pages in the browser stay closed. Because the app runs with the user’s own permissions, the level still needs View Items, Add Items and Edit Items so the app can read and write.

🔧 How It’s Done

1. Create a custom permission level

🔸 Go to Site settings > Site Permissions > Permission Levels.

🔸 Open the Contribute level and click Copy Permission Level.

🔸 Name it “Power Apps - Custom Permission” and add a description.

🔸 Under List Permissions, uncheck View Application Pages. Leave View Items, Add Items, Edit Items and, only if the app deletes records, Delete Items checked.

🔸 Click Create.

2. Assign it to a new group

🔸 In Site Permissions, click Create Group.

🔸 Name it (e.g. “Power App Users”) and set an owner if desired.

🔸 Select the custom permission level you just created, then click Create.

3. Add users and remove other access

🔸 Add the app’s users to the “Power App Users” group.

🔸 Make sure they are not also in the site’s Members or Visitors group. SharePoint permissions add up: membership in a group with the Edit or Read level brings View Application Pages back. On a team site connected to a Microsoft 365 group, members of that group get the Members permissions, so app users should not be members of the Microsoft 365 group.

4. Test with a user account

🔸 Sign in as a test user from the group, open the app and change an item. Then open the list URL in the browser: SharePoint denies access to the list views.

🎉 Result

App users work with the data through your Power App, and the list’s views and forms in the browser are closed to them. Validation and logic in the app are the normal path for every change.

🌟 Key Advantages

🔸 Guided usage: the app becomes the only interface users see for the list.

🔸 Fewer accidental edits: no grid editing or bulk delete in the browser.

🔸 No extra license: works with SharePoint permissions and a standard Power App.

⚠️ Good to Know

🔸 This is a usability control, not a security boundary. Users still have View, Add and Edit Items on the list, and Use Remote Interfaces is part of the copied Contribute level. Other clients that call the SharePoint API with the user’s account (a flow they build, Excel, a script) can still read and change the items.

🔸 For data that must really be protected, restrict the items themselves: item-level or folder permissions (see Tip 137 and 160), or move the data to Dataverse with security roles.

🎥 Video Tutorial

🛠️ FAQ

1. How do I remove or modify the custom permission level?

Go to Site Permissions > Permission Levels, select “Power Apps - Custom Permission,” and edit or delete it as needed.

2. Will this affect other users’ access to application pages?

Only users whose combined permissions lack View Application Pages lose it. Users who are also in a group with Read, Edit or Full Control keep full access to the list pages.

3. Can this approach be applied to document libraries and other list types?

Yes. The permission covers views and documents in lists and libraries alike. Break inheritance on the list or library and assign the custom level there if only that one should be locked down.

🔗 Related Tips

🔸 #PowerPlatformTip 137: ‘SharePoint Lists Folder Permissions’ - fine-grained, folder-level permissions to layer on top of this list-level lockdown.

🔸 #PowerPlatformTip 160: ‘Set SharePoint Item Permissions with Power Automate’ - automate item-level permission changes instead of setting them manually.