Permissions required to run a Business Process Flow.

[mikefeingold]

Trying to get a definitive answer on what roles/permissions are required to run a Business Process Flow.

I have a Business Process Flow called "Change password for portal contact". (It's from the PowerApps portal but this question isn't portal specific).

Permissions for this specific BPF can be configured via a security role:

And on the BPF editor, the security roles can be configured:

I'd like to understand how these 2 are related (if at all).

For a user with "All Users" security role - do they need security role permissions (as screenshot #1) and/or "Enable security roles" permissions (as screenshot #2)?

Does a user need any other permissions to run a BPF? I've seen some comment about requiring various Process/ProcessConfiguration/ProcessSession permissions (available on the Customisation tab).

Thanks

Mike

[Bilakanti]

@mikefeingold I don't think any other permission is required. What is the issue?

[mikefeingold]

In order for someone to be able to run the BPF, what's the minimum permissions required?

(Assume the user has correct permissions on the entities that the BPF updates).

Eg, is it sufficient for them to have only the "Enable Security Roles" permission (screenshot #2) or do they also need permissions from screenshot #1.

I tried various combinations but couldn't seem to change the behaviour.

Mike

[Bilakanti]

@mikefeingold 
1. In screenshot 1 it shows that what kind of operations that user can perform on that BPF which is required.
2. In screenshot 2 it shows that you are adding the security role with name All users to the BPF, so that it only shows to those users who are part of that security role. 
Note:  By default BPF will be shown to everyone.

[mikefeingold]

@Bilakanti 

Users should only be able to execute the BPF. Note create/edit/delete it.

So presumably the BPF should be linked to the security role like screenshot #2

Do they need any permissions from screenshot #1 (eg, Read) to be able to run the BPF, or can they all be blank?

[ChrisPiasecki · Accepted solution]

Hi @mikefeingold,

The table for your specific BPF is for storing instances of the process flow. Granting access to that table does not give users permission to modify the business process flow definition. Your users would require the System Customizer or System Administrator role to do that or create/write/delete privileges on the Workflow table, which is where the definitions for cloud flows, Dataverse workflows, and BFPs are stored.

You will need at least create/update/read on your BPF table to start an instance of it and move it from stage to stage. 

Setting the security roles in the BPF designer will dictate which roles will see the BPF. This and the order of BPFs set on a table will determine what BPF instance will be used by default for a particular user when creating a new record. 

---
Please click Accept as Solution if my post answered your question. This will help others find solutions to similar questions. If you like my post and/or find it helpful, please consider giving it a Thumbs Up.

[mikefeingold]

Hi @ChrisPiasecki 

Thanks for your response - that makes sense now. Just to confirm:

For a user to run a BPF then one of their security roles needs to (a) have create/read/write permissions on the BPF as per screenshot #1 and (b) be added to the "enable security roles" of the BPF as per screenshot #2

Mike

[ChrisPiasecki]

Hi @mikefeingold,

Step #2 is not mandatory. It's similar to setting security roles on forms or dashboards such that everyone that does have access to the table will have that BPF by default and can see that BPF on the record and choose it. 

More info here.

---
Please click Accept as Solution if my post answered your question. This will help others find solutions to similar questions. If you like my post and/or find it helpful, please consider giving it a Thumbs Up.

[mikefeingold]

Understood - thank for explaining this