Hi All,
I have two questions surrounding service accounts and Power Apps if anyone has some best practices they could share.
We use service accounts for our environments and our environments are usually in the format of DEV, QA and PROD
For example, we have a premium environment set of 3 that allows premium connectors, SQL and Dataverse use and it may follow a naming convention as so:
Premium-DEV environment for development
Premium-QA environment for testing
Premium-Prod environment for production
These three environments would have Power Apps within them. For an example, let's say that a Power App named Marketing Pictures exists in all of these environments.
The way we are doing things right now, that Marketing Pictures App would have 3 service accounts, one for each environment, where the service account is the owner of the Marketing Pictures App, with a naming convention of:
service.MarketingPictures-DEV (in Dev Environment)
service.MarketingPictures-QA (in QA Environment)
service.MarketingPictures-Prod (in Prod Environment)
My questions about best practice\best way forward are as follows:
1) Security roles: What security roles should these service accounts have? If you're working with Dataverse, usually the account that is the owner of the App requires at least System Customizer, but this role allows other access within the environment o the App. Same with Exporting and Importing the App into different environments (DEV > QA > PROD). This usually requires the System Administrator role, but then the service account can do anything within the environment including modifying Power Apps that aren't their own.
2) Security of passwords: We sometimes use third-party developers to help with actual code needed in the low-code Power Platform, or they may build an App for us. We provide the service account passwords to them so they can develop in the respective environments. For password security, is there some better way than providing the third-party devs with the passwords to the 3 service accounts and then changing those passwords (and all the connections!) for within the 3 environments?
