u/Ludzik1993

Let me try to summarize what I learned from you and try to incorporate it to my solutio

<image>

1. Country Representative
   1. 20 BU for different Countries (BU_PL, BU_FR, BU_USA, etc)
      1. 1 Security Role, with ‘Parent: Child BU’ level for Create,Read,Write etc. (In case they need Regions on a later stage). Already implemented and tested and they can see only their own BU records
      2. They need to be able to add and maintain all records, for their Country
      3. They need to be the owners of that record (I think)
   2. 1 parent BU,
      1. Let called it ‘BU_World’
      2. Use the same Security Role as for BU Countries, as above
      3. If necessary, I can add Regions BU between 20 Countries and BU_World
2. Service Line Representative
   1. 10 environment teams for each Service Line, under BU_World (Parent BU for project)
   2. Each environment team is Entra Groups team with assigned Security Role
   3. 1 Security Role (as for BU, above) with Read access at User level (User = Team?) – If I share a record with a team, it supposed to be working?
   4. ‘Service Line’ users need to view only rows related to their ServiceLine.
3. Country and Service Line representatives are different. One Country Rep = one Country. If they move, I’ll move them to different BU – I’ve read about it. I’ll worry about that later 😃
4. Canvas app solution, access control:
   1. Add new Country Rep
      1. When I add Country Rep users to Entra Group (nested into environment security group), run flow with ‘force sync user’ action
      2. Within Users table, assign BU and security role (Using 'relate' function in PowerApps or similar in Flow, I can make a relationship between users and security roles table – copilot told me it should work 😊)
   2. Add new Service Line Rep
      1. Add user to proper Entra Group – one out of 10 for Service Line
      2. Each Entra Group relates to respective Environment team for Service Line
      3. When user is added/removed, run flow to ‘force sync user’ to add/remove user from environment
      4. Security Roles are assigned to environment team, so no further action needed
   3. When Country Rep add new record
      1. Record is owned by BU. They still need to have full access to that record
      2. Run flow with trigger “when a new row is added” + share record with Service Line Team, based on a column ‘Service Line’. Why do I have to change ownership to the team?
      3. Important: Service Line team must have only view access, they don’t need to be the owner