Copied roles - visibility problem with environments.

[mdrapala]

Hi everyone, 

I have noticed strange system behavior.  I am preparing security roles, business units and users in new environment. In my case I have a user that is assigned to two environments - developer and sandbox one. In both he has standard "Environment Maker" role and in menu can choose on which one he want to work ( see all of them: Developer, Sandbox and default). I also added business units - I want to restrict previligies in my application. For this reason i have copied "Environment Maker" role and named it "Environment Maker BU". In this new role I added permissions to my custom entities on business unit level. And now, when I add a new role "Environment Maker BU" (in Sandbox or Developer environment)  to my user, and refresh Power Platform - he don't see this environment in menu. Bu on the other hand when I change it to standard "Environment Maker" he still see right environments in menu. He also see them when is assigned to copied role "Environment Maker BU" and additionaly has some standard role like "Basic user".  It looks like I can not use roles that are copied, because then I loose possibility to switch between environemnts in my platform. Has someone the same problem ? Will be greatful for any directions.

[DeviKrishna]

Hi @mdrapala ,

To show or hide environments for an user always use Environment Maker role if there is no Database associated. Use the copied role to grant other privileges, in your case access to custom entities.

In this way you will be able to use copied roles.

-------------------------------------------------------------------------
If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

My Blog: Dynamics 365 Key Topics – https://d365topicsbydk.com/

My YouTube Channel : https://www.youtube.com/channel/UCxSIryP2ah2VpEFr-Z72t1A

Regards
Devi

[mdrapala]

Hi @DeviKrishna,

thanks a lot for your comment. It means, that when we have more than one environment where our users are working - we should always add them standard "Environment maker" role. It is a little bit strange for me, because my copied role "Environment maker BU" has the same settings like standard one (with previligies to custom entities) and it doesn't work - maybe how the system works.

But what is more surprising for me -  I also see environments in menu,  with copied role "Environment maker BU" and wiht standard role "Basic user" (without standard Environment maker). Could you explain it ? This is some Microsoft bug or  ootb functionalities ? Additionally would like to say that all of my environments have Dataverse - in this case i also need to always use standard role ?

Will be greatful for additional explanation. 

Regards, 

Maciej

[DeviKrishna]

Hi @mdrapala ,

Environment Maker role is specific to environment. System checks if this role is available for an User and enables that specific environment to user. If you cannot see an environment which means you don't have access to view the environment.

Consider the following, 

You have Environment A and Environment B.

Case 1: User 1 has Environment Maker role in both A and B environments. Result : User1 can see both environments.

Case 2: User 2 has Environment Maker role in Environment A and not Environment B. Result: User 2 can see only Environment A.

Case 3: User 3 has Basic User role in Environment A and Environment Maker role in Environment B. Result: User 3 can see both Environments. However sharing Apps and other privileges might be missing in Environment A.

Case 4: An User 4 has custom role in Environment A and Basic Role in Environment B. Result: User 4 can see only Environment B. However sharing Apps and other privileges might be missing in Environment B.

-------------------------------------------------------------------------
If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

My Blog: Dynamics 365 Key Topics – https://d365topicsbydk.com/

My Youtube Channel : https://www.youtube.com/channel/UCxSIryP2ah2VpEFr-Z72t1A

Regards
Devi

[mdrapala]

Hi @DeviKrishna, 

I have tested all of these cases, and here is my results:

Case 1: User 1 has Environment Maker role in both A and B environments. Result : User1 can see both environments. --> It works fine

Case 2: User 2 has Environment Maker role in Environment A and not Environment B. Result: User 2 can see only Environment A. --> It works fine

Case 3: User 3 has Basic User role in Environment A and Environment Maker role in Environment B. Result: User 3 can see both Environments. However sharing Apps and other privileges might be missing in Environment A. 

--> When user has only Basic User role in Environment A then he doesn't see this environment (he is not able to choose in menu). Ofcourse he has permissions to model-driven app and custom table (it works when i run directly application from link). And that is my case - I would like to let users to choose environment for testing model-driven apps in different environment (DEV, TEST ) but without possibility to make something in such environment (adding new resources etc./without Environmen maker role). Is it possible in Power Apps ? As i found we can do this by copying link for application and send them f. eg. on e-mail, but maybe we can do it more user firendly (in one menu users have applications from different environments).

Case 4: An User 4 has custom role in Environment A and Basic Role in Environment B. Result: User 4 can see only Environment B. However sharing Apps and other privileges might be missing in Environment B. --> In this case users also don't see Environment B.

Will be thankfull for any directions:)

Regards, 

Maciej

[DeviKrishna · Accepted solution]

Hi @mdrapala ,

Case 3: User 3 has Basic User role in Environment A and Environment Maker role in Environment B. Result: User 3 can see both Environments. However sharing Apps and other privileges might be missing in Environment A. 

--> When user has only Basic User role in Environment A then he doesn't see this environment (he is not able to choose in menu). Ofcourse he has permissions to model-driven app and custom table (it works when i run directly application from link). And that is my case - I would like to let users to choose environment for testing model-driven apps in different environment (DEV, TEST ) but without possibility to make something in such environment (adding new resources etc./without Environmen maker role). Is it possible in Power Apps ? As i found we can do this by copying link for application and send them f. eg. on e-mail, but maybe we can do it more user firendly (in one menu users have applications from different environments).

Case 4: An User 4 has custom role in Environment A and Basic Role in Environment B. Result: User 4 can see only Environment B. However sharing Apps and other privileges might be missing in Environment B. --> In this case users also don't see Environment B. 

Case 3: User 3 has Basic User role in Environment A and Environment Maker role in Environment B. Result: User 3 can see both Environments. However sharing Apps and other privileges might be missing in Environment A. 

--> When user has only Basic User role in Environment A then he doesn't see this environment (he is not able to choose in menu). Ofcourse he has permissions to model-driven app and custom table (it works when i run directly application from link). And that is my case - I would like to let users to choose environment for testing model-driven apps in different environment (DEV, TEST ) but without possibility to make something in such environment (adding new resources etc./without Environmen maker role). Is it possible in Power Apps ? As i found we can do this by copying link for application and send them f. eg. on e-mail, but maybe we can do it more user firendly (in one menu users have applications from different environments). -Yes you can share the web links of Apps from each environment and need to share the Apps for User in Each environment. In that case user can see the Apps. Basic Users need shared Apps to view in any environment. If there are apps shared from dev and test environments, then they will be able to switch between environments to view those Apps.

Case 4: An User 4 has custom role in Environment A and Basic Role in Environment B. Result: User 4 can see only Environment B. However sharing Apps and other privileges might be missing in Environment B. --> In this case users also don't see Environment B.  -> In this environment B are there any Apps shared with the user? Else user will only be able to see the default environment and cannot switch.

Regards

Devi