PowerPlatform User Access for Different Environment Types

(0) Share

Report

Posted on by ST-24070323-0

113

Dear Team,

Currently we are developing an app (Canvas App and Data Source is SharePoint) using a solution in the default environment. We have a Stage and Production Environment of type Production. When creating a environment it asks to assign a security group for the environment. What does assigning this security group to environment mean? On the MS article it mentions users of that security group become members of a particular environment. What does this mean? Does it mean that users get Environment Maker Role in the environment?

Below are some of my questions.

1. The Stage environment will be used only by a few testers who will test the app. Do i need to assign a security Group to the stage environment.

2. I will share the app to the testers and they will have access. Do they need to be assigned Basic User role in environment or just sharing the app with them would work?

3. In Production the app will be used by all company users. So what would be the best approach here. Should i create a security group which contains all the users and assign the group to the environment? After assigning a security group to an environment do i need to share the app as well?

4. After assigning a user with Basic Role and sharing the app the user was able access the app however he was not able to run a flow which the powerapp was calling. Do we need to share the Flow as well with users?

Categories:

Governance & administering

I have the same question (0)

All responses (2)

Answers (0)

Suggested answer

TuongDoan 573 Moderator on at

Like (0)

Report

If you’re prompted to choose a security option while sharing, your app is connecting to Dataverse. Check your application and ensure there are no Dataverse tables in the Source section.

Then try remove them from shared list, and try re-sharing again

---------------------------
If the solution works, please kindly ✅ check the box "Does this answer your question?" on the bottom left! This will help others in finding the solution more expediently 😄 Also, a Like would be a great compliment!

Was this reply helpful? Yes No
Suggested answer

AlbertoCastro 1,201 Most Valuable Professional on at

Like (0)

Report

Hello,
1. It is a good practice to assign an Entra ID security group to all environments. This filters out users who are only going to use that environment. If a security group is not configured, all users in the tenant could access it, not directly, but potentially.
2. If your data source is Sharepoint, you do not need to assign them any security role. Security roles are for working with Dataverse tables. In this case, in addition to sharing the application, you must ensure that users have access to the sharepoint.
Recommendation: if you group users in a security group and share the application with that group and give that group access to the sharepoint, you centralize user management.
3. If the application is going to be used by the entire tenant, you could not assign any security group or if your environment has a security group, I think there is a group in Entra ID that is All users, with all users in the tenant, and you could include it as a member of the environment's security group. And share the application and the sharepoint with this All users. 4. You have 2 options: either share the flow with users or use the run-only option so that the owner of the flow is the one who always runs it.

Was this reply helpful? Yes No