Power Platform: Custom administrator and developer role

Custom security roles on Power Platform are mostly used for Dynamics and model-driven apps, but they also work for canvas apps. By default an environment (without a Dataverse database) has two default roles (environment maker and environment admin). However if you create and environment with a Dataverse database, you get the ability to create custom security roles and 10 default roles. I strongly advise not to change the default roles.

Custom administrator role

At the moment of writing this blog it is possible to alter the default environment maker role (not system administrator), but I would not recommend it. Microsoft might push changes to the default roles and overwrite the customizations.

Creating a copy of the system administrator role or the environment maker role and making changes to the copied role, is also not an option. In the background Microsoft sets the CanEdit privilege to the administrator/environment maker role, and if you copy the role the CanEdit privilege is lost. The CanEdit privilege can only be set by Microsoft.

This practically means that creating a custom administrator role is not possible.

Note: Granting a user a role that effects the CanEdit privilege will take a non-specified amount of time to take effect. For example, if you switch from a copied role to a default role, it can take 30 minutes for the change to take effect.

Custom developer role

Creating a custom developer role is possible if you are willing to accept the following scenario. The developer gets an custom security role granting the required privileges, for example the ability to work with solutions and canvas apps but no export privileges. With only this security role the developer cannot access the environment and is missing the hidden CanEdit role.

The CanEdit role can also be granted by being an owner or a co-owner of a canvas app in the environment. If an administrator creates a canvas app and makes the developer co-owner of that app then the developer can access the environment and has the hidden CanEdit role.

Share

2 Replies to “Power Platform: Custom administrator and developer role”

  1. Contact Leonardo today for any hacking Issues.
    He helped me to get into my husband’s phone remotely and he helped me to gain justice to my husband’s infidelity activities. He is professional and nice hacker to work with …Contact him on his email for hire or to know more about his services

    Leonardomitnickhacking@gmail.com

  2. Announcement.
    Don’t give up without a fight, even if you’ve lost money. I always thought it couldn’t be done, but I kept trying even after I’d lost a lot of money since I couldn’t afford to lose it all. I really don’t want to go into detail, but if you’re going through this and you’ve been duped of hard-earned money you can get your money back because I did. BLU is a LEGIT-HACK**
    :bluhack@solution4u .com”

    Your refferal name is kim sydney

Leave a Reply

Your email address will not be published.