Do I need an admin role to create, edit, and assign security roles?

[Mgodby]

Hello. I am trying to find the minimum roles required to allow a user to create apps, entities, and roles and assign those roles to a user. I looked online at some documentation and saw this:

It says here that to create and update security roles we need to assign the System Customizer role in addition to the Environment Maker role. But in order to edit, create, and assign security roles don't you need to be in the admin center? And don't need to be admin to do that? When I give the user System Customizer and Environment Maker roles and then go to the admin center, the Environment isn't listed. 

Do you need to be admin to create, edit, and assign security roles? 

[Pstork1]

The Dynamics System Customizer role is an Admin role.  So yes you will need an admin role for that, but the minimum role required is System Customizer.

[Mgodby]

Even when I give the user both Environment Maker and System Customizer they are still unable to access the admin center for the environment. When I go to admin center there is no option to pick my environment. Also when I go to Solutions and try to create a Security Role, I'm unable to, there is no option to create it and save, just close.

But when I set them to System Administrator then I can. There is a save option.

Can you edit and assign security roles outside of the admin center? 

[ACahill]

Hi @Mgodby 

Thanks for the question.  I’ve reviewed the article you’ve also reviewed i.e.:

Configure user security to resources in an environment

https://docs.microsoft.com/en-us/power-platform/admin/database-security

And the following stands our with regards to CDS database, from the experience you’re reporting, there appears there is a CDS database and thus why System Administrator would be required:

If the environment has a Common Data Service database, a user must be assigned the System Administrator role instead of the Environment Admin role for full admin privileges, as described in the preceding table.

Let us know if this helps explain or if you had any other questions around this.

[Mgodby]

Yes the Environment does have a CDS database. I just want to confirm that if I want to edit and assign roles then I need the System Administrator role?

[ACahill · Accepted solution]

Hi @Mgodby,

Yes, to work with Security Roles, you would need System Adminstrator Security Role.  

Cheers,

Allan