Model Driven App Access Sharing & Unsharing Query

[Eagerboy]

Hi everyone,

I understand in order to share a model driven app, we must first do these 2 things:

1. App level, assign a role.

2. Assign users to the role.

Here's my question, I can't seems to remove the standard roles (system administrator & system customizer) from the app level sharing, which resulting all the system administrator and system customizer able to access my model driven app. Even if I unchecked the boxes, and save it, the access is still remains there when I check back.

My company is using powerapps per app plan, and with this scenario, basically it used up all my per app plan unit.

Any idea if we can just remove the system administrator and system customizer access on app level? Thanks for help.

[Anu_Gupta]

You can follow the below link to customize the security role for the MDA -

https://docs.microsoft.com/en-us/powerapps/maker/model-driven-apps/share-model-driven-app#create-or-...

[Eagerboy]

@Anu_Guptathanks for the reply. I do have a customized security role for the MDA.

My issue now is this, I cannot remove the access of system administrator or system customizer role. Seems like my MDA is stuck with these 2 roles no matter what.

[Anu_Gupta]

This is same even for me in my test environment.

The role that you are showing is for the Apps (And for the App, by default - these 2 are selected) 

You can remove the roles when you share this to any user and remove it like below- 

Sharing this will no longer keep the Sys Admin / Customizer role to the Shared user.

[Eagerboy]

@Anu_Guptathanks for the reply. If we remove the user role as per your screenshot, won't it affect the whole environment?

For example, user01 supposedly to be the system administrator for this env, if we now remove the name from this MDA sharing option, I notice the user itself will no longer having system administrator role under the admin portal page. Seems like there is distinction between environment and app level on this MDA role.

[poweractivate]

@Eagerboy 

What @Anu_Gupta  actually said, is that the roles System Administrator and System Customizer are roles that cannot be removed because these are specific out of the box security roles that have very special meaning. What you can do as you were already advised by Anu is to create a new Security Role. When sharing the app, make sure the OOB roles are unchecked and the custom roles are checked. 

Also be sure about one more thing: that the User themselves in the underlying Environment is unassigned the OOB Roles and only assigned the custom role as well, because if not they will remain with all the full permissions anyway if you keep them assigned with System Administrator role at the User level. 

[Eagerboy]

@poweractivatethanks for your reply. Yea, I get what Anu said, and I did have a custom roles.

I am not trying to remove the OOB roles from the environment, I wanted to unchecked it when I sharing my app (my bad, poor choice of word in earlier posts). But even though I unchecked and share, the checkbox is still ticked when I check back the access authority. I believe this is what Anu encountered also. Seems like for MDA, system administrator and system customizer roles must be selected as default authority and we cant unchecked the roles.

Thanks for your advice though, I think the only option now is to unassigned users' OOB roles, and create equivalence custom roles for them.