Project PowerApp Permissions

[KAnsell]

Hi Everyone

My organisation is not yet using the Microsoft Project PowerApp, or Project for the Web, however I have used it at my former employer to great success as a PPM suite.

i have requested the permissions of System Customizer and Environment Maker to the default environment where project is deployed by default and I understand it is supposed to be.

However my new employer is resisting providing this level of permissions, but won’t explain why.  I suspect there are mission critical apps in the default environment which shouldn’t be there.

can anyone confirm or preferably point me to a Microsoft page that specifies the security roles needed for someone to customise the out of the box Project PowerApp (specifically I want to use the project accelerator pack).  I know that needs to be installed by a PowerApps Admin, and I’m happy to get them to do that for me, but it’s the ongoing customising and publishing of tables and building out the Project App as a full PPM that I need.

any help appreciated.

thank you 

[joe_hannes_col]

Hello @KAnsell,

The system customizer role would be sufficient for customizing Power Platform solutions. However, I suggest using another approach to customize Project.

If I understood it correctly, your organization is using the Default environment as a production environment for Project. A better practice would be to deploy Project to another, maybe even a dedicated, production environment, as organizations only have limited control about governance in the Default environment.

Then your organization could also set up a development (and a test) environment. In this environment, you would have the System Customizer role and could perform your customizations. A solution containing your customizations would then first be deployed to a test environment and then to the production environment.

In these environments, you could have different roles with less privileges than System Customizer, for example.

[KAnsell]

Thanks for the idea Joe.

however the Microsoft project PowerApp documentation states to use Project properly with all its integrations with the likes of Teams etc… it my be in the default environment.  This is why they suggest in the Environment Strategy documentation to not deploy mission critical apps into the default environment, and it should be used as a Personal productivity environment for business users and groups as it hosts SharePoint and Project.

i did try deploying Project to a dedicated environment to see what the limitations were, but that proved it didn’t work properly at all.

i know it works properly with the System Customizer security role, what I’m trying to find is a Microsoft Project config page I saw a year or so ago that specifically stated this so the correct role (along with environment maker) to give to the Project PowerApp owner (which would be me).

[joe_hannes_col]

Hi @KAnsell,

Even if you use the Default environment for production, it would still be better to use another environment for development to ensure you are not directly editing a productive app. You could then deploy your changes only after you have successfully tested them, and as a developer, you would not need a highly privileged role in the production environment.

Are you looking for this page? It details the security roles you need for editing.

[KAnsell]

No that’s not the page I was looking for, but it might be helpful.

[Velegandla]

@KAnsell 

"Project for the web is available for use in the Default environment and in Sandbox and Production Dataverse environments."

https://learn.microsoft.com/en-us/project-for-the-web/deploying-project 

The default environment only makes it easy for everyone to join, but you can configure permissions in a dedicated environment. 

Follow the above steps in the link, and it should work as expected. 

Make sure whoever provisions the new environment, they enable the apps. 

====================================================

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

https://www.linkedin.com/in/devendravelegandla/ 

[KAnsell]

Hey Velegandla

Thanks for the suggestion, however I need project to be working in the default environment for other reasons.  To use it outside of the default environment then all project users have to create and edit their projects in the Project PowerApp, rather than just in their browser (which introduces additional complexity) and you lose the ability to link to the plans in MS Teams.  I’ve tried it and it doesn’t work.

The Project PowerApp is only going to be used by myself for Program and Portfolio Management for the first year or so, so having it in the default environment as a production app is fine for now and it lets other PMs continue to create their plans in the project for the web via their browser where they are accustomed to doing so, yet I can manage and report everything using the Project PowerApp and PowerBI.

Appreciate the suggestion but I am really just looking for an official link with the security configuration requirements for the Project Power App including customisation when installed in the default environment.

[Velegandla]

@KAnsell 

It seems you do not need additional security config for the users to manage projects. 

There’s no additional configuration needed to enable users to manage Projects in the Default environment. Users in the Default environment only need a Project license to be able to create and manage Projects. 

https://learn.microsoft.com/en-us/project-for-the-web/deploying-project#configuring-roles-and-securi... 

May I know what type of customization you are doing?

====================================================

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

https://www.linkedin.com/in/devendravelegandla/ 

[Noizi]

@KAnsell I think the page you are looking for is Configure user security in an environment - Power Platform | Microsoft Learn. I have a similar issue, where I'm basically looking for a similar role to Google’s roles/resourcemanager.organizationViewer to be able to allow Resource Managers, Portfolio Coordinators, and other non-admins to view all the projects and clients using Project for the Web (in the Default environment). If anyone knows the minimum access that can be given to them to accommodate this in the Default environment, please let us know, as the solution should be similar/same for both scenarios.