PowerShell cmdlet to associate security group to powerapps environment(database created)

(0) Share

Report

Posted on by Paone

Hello,

I have the following requirement to achieve with powershell

1. Create a new powerapps environment with database

2. Create a new security group and associate it to the above environment

I am able to achieve the above functionality when the powerapps environment has no database with "Set-AdminPowerAppEnvironmentRoleAssignment" powershell cmdlet. But with database i could not find any cmdlets.

Kindly help me

Categories:

Building Power Apps

All responses (6)

Answers (0)

Sort by

EricRegnier 8,720 Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @Paone,
With a CDS database, you'll need to associate an out-of-the-box CDS security role or a custom security role to the user. This is done by adding a record to the "systemuserroles_association" N-N relationship between User and Security Role entities. Here's an exmaple with C# but you can do the same with PowerShell: https://docs.microsoft.com/en-us/dynamics365/customerengagement/on-premises/developer/sample-associate-security-role-user
Hope this helps!
Paone 6 on at

Like
a
(0)

Report
Copy link

Link copied!

Hello Eric,
Thank you for your response!!
But, here i wanted to restrict Powerapps environment access through Security Group. Kindly suggest is there any way to achieve this.
attached screenshot, where we have option to associate SG to Env in admin.powerplatform.com
Thanks in advance!
v-xida-msft Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @Paone ,

Do you want to assign a Security Group to your Environment with a CDS database?

Yeah, you are right. Currently, the Set-AdminPowerAppEnvironmentRoleAssignment PowerShell Cmdlet is only available for for environments that do not have a Common Data Service database.

If you want to assign a Security Group to your Environment with a CDS database using PowerShell Cmdlet, I afraid that there is no way to achieve your needs in PowerApps currently.

If you would like this feature to be added in PowerApps, please consider submit an idea to PowerApps Ideas Forum:

https://powerusers.microsoft.com/t5/Power-Apps-Ideas/idb-p/PowerAppsIdeas

As only available solution, please consider go to your Power Platform Admin Center, then find your specific Environment, then click "Edit" to edit your Environment details, then you could assign a Security Group to this Environment manually:

Best regards,
EricRegnier 8,720 Most Valuable Professional on at

Like
a
(1)

Report
Copy link

Link copied!

Hi @Paone
Thanks for clarifying, you can do this with PowerShell with the Microsoft.Xrm.OnlineManagementAPI and the commands New-CrmInstanceInfo and New-CrmInstance to create a CDS environments and assign the proper security group. If you want to assign a security group not on the instance but to manage the administrators, you can achieve with this with out-of-the-box Azure AD groups to CDS team synchronization:
https://cloudblogs.microsoft.com/dynamics365/it/2019/05/01/using-azure-active-directory-groups-to-manage-an-users-app-and-data-access/ . You can then use the Office 365 PowerShell Management API to add/remove members of the Office 365/AD group.
Hope this helps!
@v-xida-msft FYI
Paone 6 on at

Like
a
(0)

Report
Copy link

Link copied!

Hello @EricRegnier,

Thank you again for your response!

I tried the suggested approach in a valid instance, but no luck. im getting below error if i try the "Instance Type" as "Sandbox".

""Errors":[{"Subject":"NoAvailableLicense","Description":"Tenant does
not have licenses for provisioning an additional org. No additional instances are
available."}]

I am able to create manually from admin.powerapps.com with same user and failed to achieve the same with PS cmdlet.

could you please suggest, what i have done wrong here in the below code..

#Install the Online Management API to the current user profile
install-module Microsoft.Xrm.OnlineManagementAPI -Scope CurrentUser -force

#interactive prompt
$cred = Get-Credential

$apiUrl = "https://admin.services.crm.dynamics.com/"

Import-Module Microsoft.Xrm.OnlineManagementAPI -Verbose

#get instance info
$instances = Get-CrmInstances -Credential $cred -ApiUrl $apiUrl -verbose

#retrieve all the current deployed versions of Dynamics 365
$Versions = Get-CrmServiceVersions -ApiUrl $apiUrl -Credential $cred

#find version
$v9dot0 = $Versions | where Version -like "9.0"

#now create new instance information for our new instance that we wish to create
$instanceInfo = New-CrmInstanceInfo -BaseLanguage 1033 -ServiceVersionId $v9dot0.Id -InstanceType Sandbox -DomainName Test_DN_4_POC -InitialUserEmail <<valid emaild>> -FriendlyName "TestFN_POC" -CurrencyCode 840 -CurrencyName USD -CurrencyPrecision 2 -CurrencySymbol $ -Purpose "Test Env POC with Powershell" -SecurityGroupId <<Security Group Object ID>>

#create that new instance using the info from above
$newInstance = New-CrmInstance -ApiUrl $apiUrl -Credential $cred -NewInstanceInfo $instanceInfo -Verbose

$OperationId = $newInstance.OperationId
$OperationStatus = $newInstance.Status
Write-Output "the instance id is: $OperationId"

Thank you in advance!!
EricRegnier 8,720 Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @Paone,
Your scripts look fine and tried from my side, I'm have a different licensing model though. It can be due to a regression with the recent licensing model changes with the per app/user plans. I suggest to raise a Microsoft support ticket in the admin center: https://admin.powerplatform.microsoft.com/support for them to have a look at it.
Keep me posted, I'm curious to know the outcome.
Cheers