Unlicenced user can see, edit and save some applications in the default environment

(0) Share

Report

Posted on by RandomDept

696

I have been testing with an account that holds no Power licensing.

They can successfully logon to our Power platform and view the default directory (as expected).

When the user goes to Apps and selects the 'All" filter around 20 apps are displayed. They can be edited / saved and even published (as long as they don't have a connector requiring a premium license). Owners removed for privacy, but they all have one.

I am trying to figure out what criteria these apps have in common to be displaying for my unlicensed test account.

I ran an export from the Centre of Excellence Dashboard for PowerApps Apps (for all environments, even though I only need the default one).

Some of these listed apps can be found, but a majority are missing. Eg. '1st App' not listed at all. I tried looking for it by App ID, same thing.. Does anyone know where I should be looking trying to find these apps or why they would be showing for other users to edit / save in the default environment?

Thank you, any help is greatly appreciated.

Categories:

Governance & administering

I have the same question (0)

All responses (8)

Answers (2)

velegandla 204 Moderator on at

Like (0)

Report

@RandomDept

In the first screenshot i see all of them are model driven apps. They need Dataverse.

Do you mean the user without license can edit Model driven apps?

Second screenshot shows, SharePoint Forms. These are associated with Lists/LIbrary.
If use got access to the lists/library (Owner permissions), they can edit the forms and it doesn't need Power Apps premium license.

Did you try filtering the app in starter kit Admin app (Power Apps view) using the app name or APPIDString?

====================================================

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

https://www.linkedin.com/in/devendravelegandla/

Was this reply helpful? Yes No
RandomDept 696 on at

Like (0)

Report

Apologies, I should have filtered the second screenshot, was more of a 'this is where I'm getting the data from visual.'
The second image is from the Power Platform Admin view.
Sadly trying to find anything matching the name '1st App' or the APPID results in no hits.
I can also confirm there are only Model driven apps listed. And I can as the user with no license save, make edits and publish.

Was this reply helpful? Yes No
velegandla 204 Moderator on at

Like (0)

Report

@RandomDept
No worries 🙂
Can you check the role assigned to user on default environment?

Starter kit issue.
Check the Model drive app inventory flows are running for you.
This can verified via Admin command center app.

====================================================

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

https://www.linkedin.com/in/devendravelegandla/

Was this reply helpful? Yes No
RandomDept 696 on at

Like (0)

Report

Thank you,

It appears the model driven apps listed are unfinished / never run or published applications created by users.
The CLEANUP - Admin | Sync Template v3 (Power Apps User Shared With) flow was off, this is currently running.

I also see that the user permissions for the default environment seems to be:
Basic User, Bot Transcript Viewer and Environment Maker which could also help explain the results I am seeing.
I assume removing the Environment Maker role will resolve the issue...The question is, how do I prevent this being assigned by default?

Thank you again.

Was this reply helpful? Yes No
Verified answer

velegandla 204 Moderator on at

Like (1)

Report

@RandomDept

Environment Maker role shouldn't be assigned by default.

Within the starter kit you have an option review the Security roles.

Go to Environment, in this case default - Related( Power Platform user roles), check this one frequently (once in 4 weeks) and this should help in auditing the security roles assigned to users.

====================================================

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

https://www.linkedin.com/in/devendravelegandla/

Was this reply helpful? Yes No
RandomDept 696 on at

Like (0)

Report

Thank you so much.

I removed the Environment Maker and Bot Transcript Viewer roles against the test account and now they cannot see those apps.
I'll update the security roles for the environment.
Inheriting someone elses setup is fun 🙂

Thanks again!!

Was this reply helpful? Yes No
Verified answer

RandomDept 696 on at

Like (0)

Report

Further to this I just found this:
https://ideas.powerapps.com/d365community/idea/5f0cedec-ab03-494b-b8af-b0d4e59c8706
Apparently, Environment Maker role is granted to users of the default Environment automatically, cannot be changed (at least in bulk) We have 60,000 users to manually doing so won't be an option.

Was this reply helpful? Yes No
velegandla 204 Moderator on at

Like (0)

Report

@RandomDept
sorry, I read as environment admins.

It seems model-driven apps are being given access at the org level.

I will test it again with other user and update here.

====================================================

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

https://www.linkedin.com/in/devendravelegandla/

Was this reply helpful? Yes No