Edit feature service for only certain portal users within group

[Jelle_Stu_PR]

I have a question on how I need to share a feature service with editing capabilities in a certain scenario.

I have a hosted feature service A in ArcGIS Enterprise 10.9.1 that needs to be edited by certain users. The edit capabilities of this hosted feature service is therefore turned on.

In a web app, only certain users got accces through a portal group. Some of these users (user A and B) have a editors or creator portal user type. This means they have the capability to edit features. The given member role is set up so that the user gets 'Edit' capabilities but not 'Edit with full control'.

How can I achieve that user A IS allowed to perform edits within the web app on feature service A but NOT user B. Because they both have edit rights from their user type, they both can edit the feature service. Working with a layer view will not work because then user A won't be able to perform edits. Sharing the feature layer in a separate portal group with 'shared update' rights with user A won't help because user B is still able to edit the feature service because of the user type capabilities.

Then, imagine in theory that there is also an editable hosted service B within the same web app. Now the roles are reversed: user A is not allowed to edit it, but only user B. How can you achieve that ? In other words, can you manage the editing capabilities of a hosted feature service with two users who both have editing rights from their user type and role.

best,
Jelle Stuurman

[ChristopherCounsell · Accepted solution]

Users both have editing privilege. This can't change.

What can change is access to the content. You need to set up the layers, maps and apps for the group not the users.

1. Create two groups. One for editing and one for not. Put the users in the separate groups.
2. Create two hosted feature layer views, one with editing, one without.
3. Create two maps and apps. One with the editable layer, one with the non-editable layer.
4. Share the appropriate map, layers and apps, to the appropriate group.

Typically steps 2-3 would involve different usergroups. E.g. fieldworkers and office staff.

You can reduce the additional efforts of duplicating content by using save-as/copy and replace. Or leverage python to copy and replace source url content. Depends how often this situation arises for you. For us, the setup is very different for the different audiences, so we can't clone it like this.

The other advantage of this is that it sets you up for future changes, accommodating your audiences. 
I've seen scenarios where people add a viewer account to an 'editable' group thinking it doesn't matter based on their licence type. When the users licence got upgraded for an unrelated project, they now had undesired unrestricted access to the content

[Jelle_Stu_PR]

Hi Christopher,

Thank you for your reply and answer. I was already afraid my scenario was not possible witihn one app. I already have set up for another use case 2 web apps one where the editing can be done and one where the viewing can be done. I was hoping this could be solkved within one app, but that does not seem the case.

I do have a question about step 2: how can you make an 'editable view'. How can a view be editable? I know a view is also a way to make other visualisation but from what I can understand is that you can make it also editable.  

edit: it looks indeed that you can make a view editable. Intresting, never realised that. The primary feature of the view is therefore the visualisation differentations.

[ChristopherCounsell]

https://enterprise.arcgis.com/en/portal/latest/use/manage-hosted-feature-layers.htm

Hosted feature layer views have some configurable setting independent of
their hosted feature layer.

Enable editing on the view layer.