Project / Delivered
Model-driven app & governance
A model-driven app for a client whose delivery ran heavily on contractors. They wanted to work in Teams with OneDrive-synced folders – but Teams gives every private channel its own SharePoint site under the hood, which turns "a few channels" into a sprawl of separate site collections and an unmanageable sync problem. I built a provisioning framework that keeps the data in one governed place while still giving each private channel its own locked-down space.
- Status
- Delivered
- Group
- Client Work
- Stack
- Power Apps (model-driven), Dataverse, Microsoft Teams, SharePoint Online, Entra ID security groups, Power Automate
- Repo
- Previous employer — private (Azure DevOps)
- Related writing
- Internal only (previous employer)
Architecture
- Centralised the data in the root site instead of letting each private channel keep its own. Rather than accept a separate SharePoint site per private channel (Teams' default, and a management/sync nightmare with contractors), provisioning creates a folder in the main channel's root site and file-tabs it into the new private channel. One place to manage, OneDrive-syncable, no scattered site collections.
- Broken inheritance per channel so private stays private. Each channel gets its own security group and its own folder, with inheritance broken and read/write permissions applied on top. People see only their channel's data, despite it physically living in the shared root site.
- Designed within the SharePoint unique-permission-scope ceiling. Broken inheritance creates a unique permission scope per folder, so the model was built knowing where that limit sits rather than discovering it the hard way.
- Templated and ad-hoc from the same engine. Channels can be spun up from templates for consistency or created one-off, both through the same system – so governance holds whether setup is bulk or reactive.
Evidence
- Solved the Teams private-channel sprawl problem: data centrally managed in one site, access cleanly segregated per channel.
- Every channel provisioned with a matching security group, folder, file tab and broken-inheritance permission set, automatically.
- Both template-driven and ad-hoc provisioning from one framework.