Custom Environment Maker Role for Citizen Developers (Limiting Solution Access)

(1) Share

Report

Posted on by BW-26071642-0

Hello,

I am wondering if anyone has experience effectively incorporating a role with Citizen Developer level access in Power Platform. My overall goal is to create a role in which Flows can be created, but solution management and migrations are entirely unavailable and instead managed by users with elevated privileges.

I initially started with the Environment Maker role, and found that it has the unintended impact of allowing users to access, modify, or even delete solutions and their contents. It seems custom tables can also be deleted.

From there, I created a custom role based on the Environment Maker role with Solution table access removed entirely. Now I receive the following message when trying to save basic Power Automate Flows: "You are not permitted to make flows in this 'xxxx Environment'. Please switch to the default environment, or to one of your own environment(s), where you have maker permissions." This makes me think that some level of Solution table access may be required for flow creation, even when the user is not intentionally working inside a Solution.

Thank you for any thoughts or ideas.

Categories:

Governance & administering

I have the same question (0)

All responses (5)

Answers (0)

Sort by

Kalyan Shetty 12 on at

Like (2)

Report
Copy link

Link copied!
Hi there,

Your goal (“citizen developers can create flows but cannot manage/migrate solutions”) is possible, but not by removing Solution access entirely.

Start with Environment Maker (or copy it).

Restrict Solution privileges instead of removing them completely, then keep Read on Solution-related tables, remove Create/Write/Delete/Assign/Share where possible, especially avoid delete permissions on customization-related tables.

Control deployment using: Separate environments (Dev → Test → Prod) -> Managed solutions only promoted by admins -> Deployment pipelines / release ownership.

Use Environment security groups and DLP policies to limit what makers can do.

Consider making makers work only in a dedicated development environment and prevent direct production access.

Now creating the cloud flow again.

If that works, you’ve identified the minimum dependency instead of granting full Environment Maker.

Was this reply helpful? Yes No
Suggested answer

Pstork1 69,545 Most Valuable Professional on at

Like (1)

Report
Copy link

Link copied!

I tested this and it appears to do what you want, but it doesn't change the UI the way I would prefer.

1) I created a copy of the Environment Maker Role in a production environment

2) I changed permissions in the copy for the Solution Table to remove Create and Delete permissions.

When this role is given to a user they can add flows to an existing solution, but they can't Delete the solution or Import a new solution to that environment. It doesn't prevent them from trying those actions, but will raise a permissions error when they try. So it is effective. They can still modify existing solutions, since they need that permission to add new flows to the solution. They can also Export a solution since that only requires Read access to the solution. But again they need that access to see the solutions to add things to them.

----------------------------------------------------------------------------------
If this Post helped you, please click "Does this answer your question" and give it a like to help others in the community find the answer too!

Paul Papanek Stork, MVP
Blog: https://www.dontpapanic.com/blog

Was this reply helpful? Yes No
Suggested answer

11manish 3,038 on at

Like (0)

Report
Copy link

Link copied!

I would avoid removing Solution permissions entirely. Instead, provide Environment Maker access in a dedicated development environment and enforce ALM

through administrators or a platform team.

This aligns with Microsoft's recommended Power Platform governance model and is generally much easier to maintain than trying to build a highly customized

"flow creator but no solution access" security role.

Was this reply helpful? Yes No
BW-26071642-0 5 on at

Like (0)

Report
Copy link

Link copied!

"1) I created a copy of the Environment Maker Role in a production environment

2) I changed permissions in the copy for the Solution Table to remove Create and Delete permissions."

Thank you for this suggestion. It does seem to prevent Solution modification as hoped, with the notable drawback of also preventing Flow creation in the Environment. I am wondering if you have found this to be the case as well?

I receive the following message when attempting to save a new flow: "You are not permitted to make flows in this 'xxxx Environment'. Please switch to the default environment, or to one of your own environment(s), where you have maker permissions."

Was this reply helpful? Yes No
Pstork1 69,545 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

Make sure the user has Basic User role as well. When I removed Create and Delete from the Solution table the user was still able to create flows. Something else is preventing you from making flows in that environment. Removing create and delete from the solution table only keeps you from creating or deleting new Solutions, not flows.

----------------------------------------------------------------------------------
If this Post helped you, please click "Does this answer your question" and give it a like to help others in the community find the answer too!

Paul Papanek Stork, MVP
Blog: https://www.dontpapanic.com/blog

Was this reply helpful? Yes No