We have a project in place that assigns surveys to ArcGIS online named users. They log in through the mobile app and fill out the survey and submit.
The issue is that now this user can log in through ArcGIS online, find the Feature Layer, and edit the data. Is there a way where we can allow the user to submit surveys to this layer, but not be able to edit the layer itself? I tried messing with the Edit settings but if I stop them from being able to edit the data layer, they aren't able to submit the survey.
The short answer: no. In order for a service to be editable in S123, it necessarily will be editable elsewhere by users with the same permissions.
There is a way you might get around this!
Once a user submits to this survey, the feature will "drop off" of the view layer, as it no longer meets the view definition criteria. The "completed" features can still be visible via the non-editable layer, but can no longer be edited by your users.
This still doesn't prevent users from simply opening the "editable" view layer somewhere else, but it can at least give you more control over which features are exposed.
This is an interesting concept. We sort of have this in place already in that once a user submits a survey, that Status is assigned Complete and drops off their Survey123 app. I will have to explore this "view" layer and see if this works for us. Thanks!
Membership is assigned a named user type, privilege and role and these capabilities are enabled to that member regardless of which application they are logging into. The Editor, Field Worker and Creator named user types have feature level editing capabilities 'out of the box' to Essential Apps in ArcGIS Online\Portal for ArcGIS. Unfortunately, there is no application level setting to prohibit access only to ArcGIS Online or only to Survey 123 or to both. This would be a good enhancement idea though and worth submitting in ArcGIS Ideas page of this community.
Trouble is, under the hood, S123 is just submitting an Apply Edits request, which doesn't have anything "in" it that would differentiate between clients. An enterprising user could submit the whole edit via a URL request. Perhaps that will change with a later version, though.