cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
kbirstein
Helper II
Helper II

Dataverse Security Roles - Solution with SharePoint Canvas App

Hello,

 

I'm trying to figure out what security roles are required in a Dataverse environment when promoting a solution with a SharePoint data source (no Dataverse tables utilized) from a Sandbox environment to a Production environment. With one solution I promoted (consisting of a simple app, two SharePoint lists in two sites, a component and 2 simple Power Automate flows), users could not open the app until I added the Basic User and PowerAppsRPRole security roles. I struggled with this for a day or so before I found one reference somewhere (unfortunately I lost the link to the reference and now can't find it!) that said users needed these two roles when a solution was promoted.

 

However subsequent testing with other similar solutions do NOT require these security roles when I promote them to production. There is only one reference in all of Google that I could find regarding the PowerAppsRPRole--the System and Application Users page.

 

This page references two roles, PowerAppsRPRole and Flow-RP. It's interesting that my solution did not require the Flow-RP role even though I have flows in my solution. I am writing an article for LinkedIn on how to promote solutions with canvas apps and SharePoint and I'm blocked on publishing it because I can't figure out why some solutions require Basic User and PowerAppsRPRole and similar solutions do not. Any help would be greatly appreciated!

 

SecurityRoles.jpg

 

 

1 ACCEPTED SOLUTION

Accepted Solutions

PowerAppsRPRole might be specifically for the "# PowerAppsRPRole" application user which seems to be using the solution deployment of the Power Apps (canvas and model-driven apps) based on the privileges of that role. Since it is a role for an application user, I do not think it is the role to be assigned to the normal canvas app user.

 

Basic User security role contains Basic privileges for core entities of the Dataverse where the user can write, update, and delete records that they created or owned. I don't think that is the one that the canvas app users need it too (if there is no Dataverse tables utilized).

 

If that was really a security role-specific error, it should be replicable and the user should see the same error message when those roles are removed from that user. The fact that subsequent testing with other similar solutions do NOT require these security roles seems like it was due to one of the required privileged was fulfilled by adding those x2 roles but probably not the right roles.

 

I tried sharing a canvas app with no Dataverse datasource to the user with no role and I got this error message.


The request failed with error: '{"error":{"code":"0x80042f09","message":"TryGetMaxPrivilegeDepthForUserAcrossBusinessUnits: The user with id 1ed3dcab-0774-eb11-b1ab-000d3a6aa4e5 has not been assigned any roles. They need a role with the prvReadCanvasApp privilege."}}'. The correlation Id is '1630ee06-87bf-4b39-a155-8e0024560663'.


I believe it is because the app is promoted with a solution (solution aware app) and it exists in Dataverse Canvas App table. That is why the user needs the Read privilege for that table.

 

I created a new security role with User level Read privilege for the Canvas App table and after assigning that role to the user, the canvas app can be shared to the user.

LinnZawWin_0-1694463980180.png

 

I guess that is the security role with minimum privilege required for the user to be shared with solution-aware canvas app.

If you prefer to use one of the OOB roles, you can assign any of those with prvReadCanvasApp privilege but the user will have more privileges unnecessarily than they are supposed to have.

LinnZawWin_1-1694464125438.png

 

 

 

 

View solution in original post

6 REPLIES 6
LinnZawWin
Multi Super User
Multi Super User

Is there any details with missing privilege name in the error message when the users cannot open the canvas app?

 

 

kbirstein
Helper II
Helper II

Unfortunately I don't have rights to another Production environment. I'll request another one and then test again to try to get the exact error message again. In any case, I'd really like to know under what circumstances the PowerAppsRPRole and Flow-RP roles are required. I've tested with other solutions using SharePoint and canvas apps and they don't require any security roles for users in the PROD environment. The description "to allow Power Apps/Power Automate to integrate with Dataverse" is very vague. I hate to write in my article "If users are getting an error when running you app, try adding Basic User and PowerAppsRPRole security roles to the user" (LOL!) so I'd really like to know when and why these roles are sometimes required!

PowerAppsRPRole might be specifically for the "# PowerAppsRPRole" application user which seems to be using the solution deployment of the Power Apps (canvas and model-driven apps) based on the privileges of that role. Since it is a role for an application user, I do not think it is the role to be assigned to the normal canvas app user.

 

Basic User security role contains Basic privileges for core entities of the Dataverse where the user can write, update, and delete records that they created or owned. I don't think that is the one that the canvas app users need it too (if there is no Dataverse tables utilized).

 

If that was really a security role-specific error, it should be replicable and the user should see the same error message when those roles are removed from that user. The fact that subsequent testing with other similar solutions do NOT require these security roles seems like it was due to one of the required privileged was fulfilled by adding those x2 roles but probably not the right roles.

 

I tried sharing a canvas app with no Dataverse datasource to the user with no role and I got this error message.


The request failed with error: '{"error":{"code":"0x80042f09","message":"TryGetMaxPrivilegeDepthForUserAcrossBusinessUnits: The user with id 1ed3dcab-0774-eb11-b1ab-000d3a6aa4e5 has not been assigned any roles. They need a role with the prvReadCanvasApp privilege."}}'. The correlation Id is '1630ee06-87bf-4b39-a155-8e0024560663'.


I believe it is because the app is promoted with a solution (solution aware app) and it exists in Dataverse Canvas App table. That is why the user needs the Read privilege for that table.

 

I created a new security role with User level Read privilege for the Canvas App table and after assigning that role to the user, the canvas app can be shared to the user.

LinnZawWin_0-1694463980180.png

 

I guess that is the security role with minimum privilege required for the user to be shared with solution-aware canvas app.

If you prefer to use one of the OOB roles, you can assign any of those with prvReadCanvasApp privilege but the user will have more privileges unnecessarily than they are supposed to have.

LinnZawWin_1-1694464125438.png

 

 

 

 

kbirstein
Helper II
Helper II

Thanks so much Linn for testing this out! There is absolutely no Microsoft documentation about what is necessary for canvas apps when no Dataverse tables are used but this error message is pretty clear. I think what a lot of people are doing is simply making all their users Environment Maker which is so wrong.

I agree. Microsoft should create a new predefined Canvas App Opener just like the "App Opener" role for the model-driven app.

 

 

kbirstein
Helper II
Helper II

Hi Linn and Forum Readers,

 

Just to be clear to anyone reading this post about the test solution that I built and the error I am getting, which was resolved by creating a custom security role that gives User the Read right to the Canvas App table, as Linn suggested (see Linn's screenshot above). Here's the exact contents of the solution I tested with.

 

  • Canvas Power app with one Form to create new items in a SharePoint list
  • Canvas App runs a Power Automate flow in the OnSuccess property of the form, passing the LastSubmit.ID
  • A Power Automate flow uses the Power Apps V2 trigger and does a SharePoint "Get Item" action with the ID and then sends an Outlook 365 email with information supplied by the "Get Item" action.
  • There are two Connection References, one for SharePoint and one for Outlook, created by the Power Automate flow
  • There are two Environment variables, created by the Power App, for the SharePoint site and the SharePoint list

That's all that's in the solution. The solution is shared with two people, the developer Owner and a User. In the DEV environment the User has no security roles and Owner is System Administrator.

 

The User can run the Power App just fine in the Sandbox DEV environment with NO security role. When the solution is promoted to the Production PROD environment (with the SharePoint site/list being changed to the SharePoint production site/list on Import), the Owner can run the solution fine but the User gets an error "Connection not configured for this service" in Power Apps. What is happening is that the user CAN create an item in the SharePoint list but the flow will not run. It doesn't fail, it simply does not run. 

 

Granting the user the custom security role resolves this issue. So it seems the Outlook 365 connection is the problem since the SharePoint connection appears to be working. I don't get the "User has no role" error that Linn got but probably that is the underlying error underneath the "Connection not configured for this device" error (which if you Google it is a very generic error.) The weird thing is that no security role is necessary in a Sandbox environment but the user needs to have the Read right to the Canvas App table in a Production environment. So there is some difference between these two types of environments that is not documented. Microsoft, how about an explanation for this difference?

 

Cheers, Kathryn

Connection Error.jpg

 

 

 

 

Helpful resources

Announcements

Check out the Copilot Studio Cookbook today!

We are excited to announce our new Copilot Cookbook Gallery in the Copilot Studio Community. We can't wait for you to share your expertise and your experience!    Join us for an amazing opportunity where you'll be one of the first to contribute to the Copilot Cookbook—your ultimate guide to mastering Microsoft Copilot. Whether you're seeking inspiration or grappling with a challenge while crafting apps, you probably already know that Copilot Cookbook is your reliable assistant, offering a wealth of tips and tricks at your fingertips--and we want you to add your expertise. What can you "cook" up?   Click this link to get started: https://aka.ms/CS_Copilot_Cookbook_Gallery   Don't miss out on this exclusive opportunity to be one of the first in the Community to share your app creation journey with Copilot. We'll be announcing a Cookbook Challenge very soon and want to make sure you one of the first "cooks" in the kitchen.   Don't miss your moment--start submitting in the Copilot Cookbook Gallery today!     Thank you,  Engagement Team

Announcing Power Apps Copilot Cookbook Gallery

We are excited to share that the all-new Copilot Cookbook Gallery for Power Apps is now available in the Power Apps Community, full of tips and tricks on how to best use Microsoft Copilot as you develop and create in Power Apps. The new Copilot Cookbook is your go-to resource when you need inspiration--or when you're stuck--and aren't sure how to best partner with Copilot while creating apps.   Whether you're looking for the best prompts or just want to know about responsible AI use, visit Copilot Cookbook for regular updates you can rely on--while also serving up some of your greatest tips and tricks for the Community. Check Out the new Copilot Cookbook for Power Apps today: Copilot Cookbook - Power Platform Community.  We can't wait to see what you "cook" up!      

Tuesday Tip | How to Report Spam in Our Community

It's time for another TUESDAY TIPS, your weekly connection with the most insightful tips and tricks that empower both newcomers and veterans in the Power Platform Community! Every Tuesday, we bring you a curated selection of the finest advice, distilled from the resources and tools in the Community. Whether you’re a seasoned member or just getting started, Tuesday Tips are the perfect compass guiding you across the dynamic landscape of the Power Platform Community.   As our community family expands each week, we revisit our essential tools, tips, and tricks to ensure you’re well-versed in the community’s pulse. Keep an eye on the News & Announcements for your weekly Tuesday Tips—you never know what you may learn!   Today's Tip: How to Report Spam in Our Community We strive to maintain a professional and helpful community, and part of that effort involves keeping our platform free of spam. If you encounter a post that you believe is spam, please follow these steps to report it: Locate the Post: Find the post in question within the community.Kebab Menu: Click on the "Kebab" menu | 3 Dots, on the top right of the post.Report Inappropriate Content: Select "Report Inappropriate Content" from the menu.Submit Report: Fill out any necessary details on the form and submit your report.   Our community team will review the report and take appropriate action to ensure our community remains a valuable resource for everyone.   Thank you for helping us keep the community clean and useful!

Community Roundup: A Look Back at Our Last 10 Tuesday Tips

As we continue to grow and learn together, it's important to reflect on the valuable insights we've shared. For today's #TuesdayTip, we're excited to take a moment to look back at the last 10 tips we've shared in case you missed any or want to revisit them. Thanks for your incredible support for this series--we're so glad it was able to help so many of you navigate your community experience!   Getting Started in the Community An overview of everything you need to know about navigating the community on one page!  Community Links: ○ Power Apps ○ Power Automate  ○ Power Pages  ○ Copilot Studio    Community Ranks and YOU Have you ever wondered how your fellow community members ascend the ranks within our community? We explain everything about ranks and how to achieve points so you can climb up in the rankings! Community Links: ○ Power Apps ○ Power Automate  ○ Power Pages  ○ Copilot Studio    Powering Up Your Community Profile Your Community User Profile is how the Community knows you--so it's essential that it works the way you need it to! From changing your username to updating contact information, this Knowledge Base Article is your best resource for powering up your profile. Community Links: ○ Power Apps ○ Power Automate  ○ Power Pages  ○ Copilot Studio    Community Blogs--A Great Place to Start There's so much you'll discover in the Community Blogs, and we hope you'll check them out today!  Community Links: ○ Power Apps ○ Power Automate  ○ Power Pages  ○ Copilot Studio    Unlocking Community Achievements and Earning Badges Across the Communities, you'll see badges on users profile that recognize and reward their engagement and contributions. Check out some details on Community badges--and find out more in the detailed link at the end of the article! Community Links: ○ Power Apps  ○ Power Automate  ○ Power Pages  ○ Copilot Studio    Blogging in the Community Interested in blogging? Everything you need to know on writing blogs in our four communities! Get started blogging across the Power Platform communities today! Community Links: ○ Power Apps  ○ Power Automate  ○ Power Pages  ○ Copilot Studio   Subscriptions & Notifications We don't want you to miss a thing in the community! Read all about how to subscribe to sections of our forums and how to setup your notifications! Community Links: ○ Power Apps  ○ Power Automate  ○ Power Pages  ○ Copilot Studio   Getting Started with Private Messages & Macros Do you want to enhance your communication in the Community and streamline your interactions? One of the best ways to do this is to ensure you are using Private Messaging--and the ever-handy macros that are available to you as a Community member! Community Links: ○ Power Apps  ○ Power Automate  ○ Power Pages  ○ Copilot Studio   Community User Groups Learn everything about being part of, starting, or leading a User Group in the Power Platform Community. Community Links: ○ Power Apps  ○ Power Automate  ○ Power Pages  ○ Copilot Studio   Update Your Community Profile Today! Keep your community profile up to date which is essential for staying connected and engaged with the community. Community Links: ○ Power Apps  ○ Power Automate  ○ Power Pages  ○ Copilot Studio   Thank you for being an integral part of our journey.   Here's to many more Tuesday Tips as we pave the way for a brighter, more connected future! As always, watch the News & Announcements for the next set of tips, coming soon!

Hear what's next for the Power Up Program

Hear from Principal Program Manager, Dimpi Gandhi, to discover the latest enhancements to the Microsoft #PowerUpProgram, including a new accelerated video-based curriculum crafted with the expertise of Microsoft MVPs, Rory Neary and Charlie Phipps-Bennett. If you’d like to hear what’s coming next, click the link below to sign up today! https://aka.ms/PowerUp  

Welcome to the Power Apps Community

Welcome! Congratulations on joining the Microsoft Power Apps community! You are now a part of a vibrant group of peers and industry experts who are here to network, share knowledge, and even have a little fun! Now that you are a member, you can enjoy the following resources:   The Microsoft Power Apps Community Forums If you are looking for support with any part of Microsoft Power Apps, our forums are the place to go. They are titled "Get Help with Microsoft Power Apps " and there you will find thousands of technical professionals with years of experience who are ready and eager to answer your questions. You now have the ability to post, reply and give "kudos" on the Power Apps community forums! Make sure you conduct a quick search before creating a new post because your question may have already been asked and answered!   Microsoft Power Apps IdeasDo you have an idea to improve the Microsoft Power Apps experience, or a feature request for future product updates? Then the "Power Apps Ideas" section is where you can contribute your suggestions and vote for ideas posted by other community members. We constantly look to the most voted Ideas when planning updates, so your suggestions and votes will always make a difference.   Community Blog & NewsOver the years, more than 600 Power Apps Community Blog Articles have been written and published by our thriving community. Our community members have learned some excellent tips and have keen insights on building Power Apps. On the Power Apps Community Blog, read the latest Power Apps related posts from our community blog authors around the world. Let us know if you would like to become an author and contribute your own writing — everything Power Apps related is welcome!   Power Apps Samples, Learning and Videos GalleriesOur galleries have a little bit of everything to do with Power Apps. Our galleries are great for finding inspiration for your next app or component. You can view, comment and kudo the apps and component gallery to see what others have created! Or share Power Apps that you have created with other Power Apps enthusiasts. Along with all of that awesome content, there is the Power Apps Community Video & MBAS gallery where you can watch tutorials and demos by Microsoft staff, partners, and community gurus in our community video gallery.   Again, we are excited to welcome you to the Microsoft Power Apps community family! Whether you are brand new to the world of process automation or you are a seasoned Power Apps veteran. Our goal is to shape the community to be your ‘go to’ for support, networking, education, inspiration and encouragement as we enjoy this adventure together!   Let us know in the Community Feedback if you have any questions or comments about your community experience.To learn more about the community and your account be sure to visit our Community Support Area boards to learn more! We look forward to seeing you in the Power Apps Community!The Power Apps Team

Users online (3,256)