The Complete Dataverse Access Teams Setup Guide

Dataverse access teams grant team members permission to a specific record in a table. They also have the ability to grant access to any related child records. Access teams are best used when a unique set of users needs access to each individual record in a table and when the number of teams needed is not known during the solution’s design. Permissions granted by access teams are in addition to access granted by record ownership and security roles. In this article I show you the complete method to setup Dataverse access teams.

Table of Contents
• Introduction: The Equipment Management App

Access Teams Setup For Parent Record:
• Create A New Dataverse Table
• Add An Access Team Template
• Setup A New Security Role
• Apply The Security Role To A User
• Add An Access Team Members Subgrid To The Main Form
• Assign A User To A Record's Access Team
• Check The Access Team Member's Permissions For A Record

Access Teams Setup For Child Records:
• Grant Access To Child Records Upon Access Team Assignment
• Define The Lookup Column Relationship Behaviour
• Add The Child Records Table To The Security Role
• Populate The Child Records Table With Data
• Check The Access Team Member's Permissions To Child Records

Introduction: The Equipment Management App

On-site Service Technicians at a printer & copier leasing company use the Equipment Management App to see information about the equipment on-lease. Technicians are added to an Access Team for their customer’s building when they become responsible for maintenance at the customer’s location.

The Service Technician can only see Building Facilities they are assigned to.

And they can only see Equipment within the Building Facilities they are assigned to.

Create A New Dataverse Table

When a Service Technician opens the Equipment Management App they will see a list of all Building Facilities they are assigned to. Open the Power Apps Maker Portal and create a new table named Building Facility inside of a solution.

Populate the Building Facilities table with the following data.

Then create a new Model Driven App named Equipment Management and add the Building Facilities table to it. The app should look like the image below.

Enable Access Teams For A Dataverse Table

Access Teams must be enabled for any Dataverse table that will use them. Go to the Building Facility table settings, find the Rows in this table settings group, and check the box for Have An Access Team. Then press Save.

Add An Access Team Template

An access team template defines the permissions-level granted to the user when they become assigned to a record’s access team. To add an Access Team template go to the solution explorer and select New > More > Other > Team Template.

On the New Team Template menu provide the name Building Facility (Read-Write-Append). Select the table Building Facility. Then specify these Access Rights: Read, Write, Append, Append To. Save and close once finished.

Setup A New Security Role

Any User assigned to an Access Team must have a security role with at least User level permissions to each Access Right (Read, Write, Append, Append To). In the Power Platform Admin Center create a new security role named Equipment Management App User.

Then grant the following permissions to the Building Facility table.

• Read – User
• Write – User
• Append – Organization
• Append To – Organization
  
  

Apply The Security Role To A User

The Equipment Management App User security role must be applied to the User who will be assigned to an Access Team. Go to the User settings in the Power Platform Admin Center and grant the new role to a User.

Add An Access Team Members Subgrid To The Main Form

Assignment of a User to an Access Team can be done using a subgrid on the Building Facility table’s main form. Navigate to the Building Facility main form in the solution explorer and choose Edit.

The main form initially has only a Name and Owner field.

Add a new subgrid to the form with the following options:

• Show related records – unchecked
• Table – Users
• Default – Associated Record Team Members
• Team Template – Building Facility (Read-Write-Append)
  
  

The subgrid now appears in the Building Facility main form. Give it the title Access Team Members and then save and publish the form. We have now completed setup for Access Teams on the Building Facility table.

Assign A User To A Record’s Access Team

When a Service Technician is assigned to work at building facility we want them to see its record in the Equipment Management App. Open the Model Driven App and browse to a Building Facility record. Select the Add User button in the Access Team Members subgrid.

Choose the User who was previously granted the Equipment Management App User security role. Then press Add.

The User is now assigned to the Building Facility record’s access team.

Check The Access Team Member’s Permissions For A Record

There are two ways the validate the newly assigned User’s access to Building Facility records. The first is to navigate to a specific record in the Model Driven App and go to Check Access menu.

In the Check Access dialog, change the User lookup field to the assigned User. We can see they have Read, Write, Append & Append To permissions because the record was shared with a team that they are a member of.

The second method to verify the User’s access to Building Facility records is to login as that User. There are 5 records total in this table. But the User only sees the single record they were assigned.

Grant Access To Child Records Upon Access Team Assignment

When assigning a User to an Access Team for a parent record we can also grant access to any related child records. In the Equipment Management App, we want to assign Users to a Building Facility’s access team and then also grant access to any Equipment at that building

Create a new table named Equipment with the following columns:

• Name (Text)
• Building Facility (Lookup)
  

Do not populate the Equipment table with any values yet. We must first configure the relationship between the Building Facility and Equipment tables. As as preview, here is what the table will eventually look like once it is filled-in with data.

Define The Lookup Column Relationship Behaviour

An access team for a parent record will cascade to the child record when the relationship behaviour is set to either Parental or Custom with Cascade All Share & Unshare. In the Equipment table the Building Facility column is a lookup type column.

Go to the relationship for the Building Facility and choose Parental as the type of behaviour. Then select Done.

Add The Child Records Table To The Security Role

The Equipment table must also be added to the Equipment Management App User security role. Grant the same permissions as Building Facility table. The child records will receive the same access permissions as the parent record they are related to.

Populate The Child Records Table With Data

Now that access teams are enabled for the Equipment table we can populate it with data. Go to the Equipment table and add these records. When the Equipment record is related to a Building Facility it shares the parent record’s access team members and permissions.

The filled-in Equipment table will look like this.

Check The Access Team Member’s Permissions To Child Records

To verify the access team members and permissions for the parented were shared go to a record in the Model Driven App and open the Check Access menu.

In the Check Access dialog, change the User lookup field to the parent record’s access team member. We can see they have Read, Write, Append & Append To permissions to the child record. This is because the User is a member of an access team for a related record.

When the User opens the Equipment table they can only see 3 records for the assigned location even though there are 10 Equipment records in the database.

Questions?

If you have any questions or feedback about The Complete Dataverse Access Teams Setup Guide please leave a message in the comments section below. You can post using your email address and are not required to create an account to join the discussion.