Unable to remove security role associated with app

[ThePowerFox]

When sharing a model driven app all selected security roles are associated with the appropriate app.
It is not possible to uncheck a previous selected (=saved) security role in this dialog.
How can the association between the model driven app and the security role be removed?

[EricRegnier · Accepted solution]

Hi @ThePowerFox,
This should be feasible quite easily with the Classic (aka legacy) interface. Try this:

1. Navigate to your environment and append to the URL "main.aspx?forceClassic=1" (e.g. https://ericdxc.crm6.dynamics.com/main.aspx?forceClassic=1)
2. Go to Settings --> My Apps
3. Click on the ellipsis on the middle right of your app
   
4. A right pane will open, expand Roles and you can uncheck the unwanted security roles (don't forget to save and close!)
   

   Hope this helps! 

[EricRegnier]

Hi @ThePowerFox,

This should be feasible with the Classic (aka legacy) interface. Try this:

1. Go to your environment and append "main.aspx?forceClassic=1" after "dynamics.com"
   e.g. https://ericdxc.crm6.dynamics.com/main.aspx?forceClassic=1
2. Go to Settings --> My Apps
3. Click on the ellipsis in the middle right of your app
   

4. A right pane will open, expand Roles and uncheck the unwanted security roles (don't forget to save and close!)
   Hope this helps!

[v-xida-msft · Accepted solution]

Hi @ThePowerFox ,

Have you tried the new Sharing UI dialog within PowerApps to share your Model Driven app?

Based on the issue that you mentioned, I have made a test on my side, I suppose that you are trying the new Sharing UI dialog within PowerApps to share your Model Driven app as below:

is it right?

Actually, it is an known issue with the new sharing UI dialog -- if you assigned a Security Role to your Model-Driven app, and click "Share" button, the assigned Security Role could not be unchecked again within the new sharing UI dialog. These assigned Security Roles would be grey and could not be edited.

As an fixed solution, you could consider go to your Dynamics 365 CRM instance (PowerApps Environment, where your current Model-Driven app hosted in) through the following URL:

https://orgxxxxxxxx.crmx.dynamics.com/

then go to "Settings"-> "My Apps":

then find your Model-Driven app there, and click "Menu Options"-> "MANAGE ROLES" option:

then you could edit these assigned Security Roles for your Model-Driven app:

Best regards,

[ROE-DK]

Edited: Just noticed x-vida-msft hasn't logged on for more than a year

[ROE-DK]

Would you happen to know how to do this with a canvas app in a solution?
It doesn't show up under Apps, and I can't find the app when looking through Settings -> Solutions -> <my solution>

[EricRegnier]

This is for model-driven apps only, not canvas app. Removing a role for canvas apps is done by sharing/unsharing the app itself in the Maker portal (make.powerapps.com). Apps --> select your app --> click the ellipsis then Share. Hope this helps!

[ROE-DK]

And of course I found the answer 10 min. after having given up 😕
When the app is shared, a new team is created under the organzation with the same name as the group the app is shared with:
From the Solution -> cogwheel -> Advanced Settings -> Settings -> Security -> Teams -> <business unit> -> Organization -> Teams
Click the relevant team and select Manage Roles