How can I remove a security role from all users at once?

(0) Share

Report

Posted on by jleystral

Hello everyone,

In our default environment, all users have the Environment Maker security role. This means that users can create apps on their own and can also create a new environment on their own. Of course, we do not want this and therefore want to centrally prevent normal users from being able to do this. How can I remove this security role from all users in the default environment? Clicking on each user individually and removing it manually for each one is not an option.

Many thanks in advance and best regards

Translated with DeepL.com (free version)

Categories:

Environment

All responses (2)

Answers (0)

velegandla 202 Super User 2025 Season 1 on at

Like (0)

Report
Re: How can I remove a security role from all users at once?

@jleystral

You can update the Tenant settings for not everyone can create environments.
https://admin.powerplatform.microsoft.com/tenantsettings
Developer environment assignments
Production environment assignments
Trial environment assignments
Update above Tenant settings only for specific admins.

This would avoid people creating environments.

Next Steps:
Rename the Default environment to personal productivity.
Minimum number of connectors using DLP
Finally:
You can update the canvas app and MDA app sharing permissions.

Below are the default settings for canvas App permissions within the maker role.

You can update it to disable the sharing.

This will stop people sharing the apps.

You can do the same for model-driven apps if Dataverse is enabled in the default environment.

====================================================

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

https://www.linkedin.com/in/devendravelegandla/
v-bofeng-msft on at

Like (0)

Report

Re: How can I remove a security role from all users at once?

Hi @jleystral ,

I'm afraid you can't delete a specific security role for all users at once. You could select the security role, view the associated members, and then delete them one by one.

In addition, due to the unique nature of the default environment, I'm afraid you can not restrict users from creating apps in the default environment.(Even if you remove the user's environment maker role, as long as the user enters the default environment, this role will automatically be reassigned to the user)

Best Regards,

Bof