Minimum access for users of app that references custom Dataverse tables

[Dr_Lee]

Hi, all

I have a simple need: I have created a canvas app in a new Environment that accesses custom Dataverse tables in galleries (through various sorted filters, summations of data, and so on). I need all my users to be able to a) access the Environment, and b) access all these galleries and calculations in the app. So, I need to find the best way to share the app with them so that they can use it. (One more point: lots of Power Automate calls in the app, however, none of them tap into Dataverse directly). The app and Tables are in an Environment for which I am System Admin.

Obviously, I need to assign the users appropriate roles, for which I have created a new role. However, there seems to be no obvious base role to base the new role on: Basic Access modified to give read and append access to the custom tables does not seem to work, and other role definitions are very ambiguous. System Customizer does not allow access to custom tables that the user does not own, but should I use it as the basis of the new role and add the rights to read and append to the custom tables? Or use System Reader?

For now, I have created a new role for all users by copying the System Admin role (not optimal!!). All my users have been added to the role, and role has been identified the Power Apps sharing for each user. However, strangely, now half my users cannot even see the Environment! So, questions on how to resolve this.

I note that for relative novices in the Power Platform security scene who are just starting to flip to Dataverse, this must surely be one of the most common needs and use cases. 

Regards