Privilege to access model driven app

[ynaing]

I would like to know what privileges are required to access model driven app.

Even after I have given the minimum required privilege (According to this documentation) plus the required privilege for database access, I cannot access the model driven app properly.

[HSheild]

Hi @ynaing 

What security roles are assigned to the model-driven app?  You can check this via the steps below.  The users must have the same security role(s) that are assigned to the app.

[ynaing]

Hi @HSheild,

Although I am system administrator, I cannot share the app. I don't know why.

[HSheild]

Hi @ynaing 

The greyed-out options indicate to me that your user did not create the app.  Who was the user that built this app?  They will have access to share it.

[ynaing]

Hi @HSheild,

Sharing issue is resolved.

The main issue is:

- I made a model driven app

- Include a custom created table (Let's call it Students)

- I assigned a user as System Admin and System Customizer 

- Test the app

Everything worked well.

Scenario 1

-----------

- I created a new security role (Let's call it "Moderator")

- Granted the role all permissions (CRUD) with Organization level for Student Table

- Assigned Basic User and Moderator role to "User A"

The user cannot access the application.

Scenario 2

------------

- Assign System Customizer Role to User A

It worked well

Scenario 3

-----------

- Clone System Customizer role by clicking copy button and named it CS Clone

- Remove System Customizer role from User A

- Assigned CS Clone to User A

- User A has Moderator role and CS Clone role

It didn't work. I got this error

User A has Office 365 Business Basic License.

I tried on another environment. I got the same result.

[jukka-niiranen]

It's not enough to just create a security role in Dataverse, you also have to explicitly associate that role with the model-driven app module. Here's the documentation.

In the share dialog, once you have selected the app on the left side list, go and open the dropdown that will show all the available security roles in the environment. Make sure to check the box next to "Moderator", then click "Share". Now the users with this role should be able to open the model-driven app.

Yes, it's an extremely confusing UI. It tries to mimick the canvas app sharing dialog, even though the underlying logic of how canvas vs. model-driven app user rights are granted is completely different. Canvas apps are shared directly to a user, just like you might share a document from your OneDrive. Model-driven apps are shared "indirectly", by associating a specific security role both with the app module and the users.

[ynaing · Accepted solution]

Hi @HSheild, @jukka-niiranen ,

Thank you for your answers. I do really appreciate it. 🙂

After 3 weeks, I finally found the root cause.

It is LICENSE!!!

MS lets us develop app, solution, dataverse, etc.

But it is not free for users. Office 365 Business Basic is not enough to use those solution though we can develop.

To be able to develop, the roles like "System Administrator" or "System Customizer" allow to test the app as user.

That's why, the user cannot access the app even if the assigned role is directly copied from "System Customizer" role.

I assigned Power App Plan 2 Trial license to user. And BOOM. Everything's ok now.

I have to buy licenses. 😄 😄 😄

The detail error message shows that I need license.

But I thought the error message is not relevant and refused to accept.

I thought, just changing security role from "System Customizer" to copied system customizer needs license is nonsense.

ha ha ha finally.