Field level security based on security roles in Entity Form/Web Form based on User Roles in Power Apps/ Dynamics 365 Portal

For training and consulting, write to us at info@xrmforyou.com

If you are looking for a new feature that has been introduced, unfortunately it’s not. Come one Debajit! Don’t be so disappointing at the start of the  blog!
But truth needs to be told! So what are my other options?

Field security profiles are not available in Power Apps Portal. Instead we have Web Page Access Control Rules which will provide access to web page with read/write access. As this can be applied to the entire web page, but in our real-life implementations we need some of the attributes to be read only even for certain users in portals. This can be achieved easily using “user” liquid object.
So let me explain here.
I have contact form where in Revenue field should be editable only by Administrators users for others it should be read-only.
Go to Contact Entity Form and under that Administration tab place the custom code in Custom JavaScript area

$(window).on("load", function() {
{% if user %}
{% for role in user.roles %}
var roleName="{{ role }}";
{% if roleName != "Administrators" %}
$('#cr6b0_revenue').attr("disabled",true);
{% break %}
{% endif %}
{% endfor %}
{% endif %}
});

What I am doing here I run the for loop and if the role name is other than Administrators then Revenue field is read only
As you can see I logged in with Authenticated Users Web role and open my contact form the Revenue field is read only

Before I end, a quick tip here!

Do not take roles collection into a variable and implement the same code. The array of roles will be type casted to string as shown below. It would give undesired results.

var roles = "{{ user.roles }}";

and check your web page source. You will see the roles concatenated as string. And it will no longer be an array you can work with.

Hope this helps!
Debajit Dutta
(Microsoft Business Solutions MVP)