Model-driven app permissions not working

[faisalje]

I'm having problems getting a user account access to my model-driven app. I'm trying to create a role with the minimum set of privileges to be able to use the app.

1) I created 2 roles, one with the minimum set of privileges Create or edit a security role - Power Platform | Microsoft Docs

 and the other role with read/write access to some custom entities plus Model-driven app Read privileges have been granted.

2) I granted the user these 2 roles

3) I added these 2 roles to the App

When I log in with the user credentials I only get the message "We can’t find any apps for your role".

If I copy the URL of an entity list [e.g. Active Accounts view] from another user account, into the browser of the new account, I can access the entity list. However, the left-hand menu is not displayed. Somehow only parts of the App are accessible rather than the entire App.

If I grant the user the System Customizer role and add this to the app, the user has access to the complete app. This indicates that the user has the proper license for the app.

Somehow there are permissions missing in the MS minimum permissions role and my new role, to be able to access the complete app.

Any thoughts?

[dpoggemann]

HI @faisalje ,

One thing to try, just to verify it is an issue with the role not having enough security is take the System Customizer role and copy it to a custom role, add this to the user, and then to the app and try again.  If you still get the same issue then it is not a privilege issue in the role but an issue with the app not seeing the new roles as allowed roles for the application.  If everything works great then it is a privilege issue within your security role and I usually would review the security permissions and add as needed until desired behavior is met.

Hope this helps.  Please accept if answers your question or Like if helps in any way.

Thanks,

Drew

Please post result of this 

[rampprakash]

Hello @faisalje  , 

Can you please try below steps, not sure this can help but just a suggesstion

Navigate to https://make.powerapps.com

Click on Gear Icon at the top

Click Advance settings

Click Apps 

Then it will take you to the screen where All Model Driven Apps Available. If there is no Model Driven App Available then create a new Model Driven app to make it visible (My YouTube link for your reference : https://www.youtube.com/watch?v=mqjP595jNts&t=1s)

Then make sure you have provided proper security role to the Model Driven app to make it work

Please mark as Answer if it is helpful and provide Kudos

Subscribe : https://www.youtube.com/channel/UCnGNN3hdlKBOr6PXotskNLA
Blog : https://microsoftcrmtechie.blogspot.com

[faisalje]

Thanks for the response. I had tried your solution previously, but tried it again just in case. I got the same result.

If I assign the User and the App the System Customizer role everything works. If I copy the System Customizer role to a new role and assign the User and the App the new role, it does not work.

So possibly as you said, somehow the App is not recognizing the newly assigned roles.

[rampprakash]

Hello @faisalje,

Hope you tried assigning the new Security Role to the Model Driven App.

Please mark as Answer if it is helpful and provide Kudos

Subscribe : https://www.youtube.com/channel/UCnGNN3hdlKBOr6PXotskNLA
Blog : https://microsoftcrmtechie.blogspot.com

[dpoggemann]

Hi @faisalje ,

You need to make sure the Model App is assigned the roles as @rampprakash mentioned as well as the users.  By default System Customizer is allowed to utilize the model apps when they are built so this is why when that role is assigned to the user it works.

Please see the following article:  https://crmknowhow.wordpress.com/2020/05/18/manage-security-roles-for-model-driven-apps-in-dynamics-... 

Hope this helps.  Please accept if answers your question or Like if helps in any way.

Thanks,

Drew

[faisalje]

Although creating a copy of the System Customizer role did not work, creating a copy of the System Administrator role did work. 

So I might take my copied System Administrator role and just start paring down the permissions to see if this will work. Not really a good hack.

[dpoggemann]

Hi @faisalje ,

That really doesn't make sense to me if when you assigned the actual System Customizer role it worked for the user.  You did validate the roles assigned to the application right?  The new roles you created for the user are assigned to the model app right?

Glad you found a work-around but does not click why for me. 🤔

Thanks,

Drew

[faisalje · Accepted solution]

The issue I was having in the end had to do with what type of license the user had.

The user I was using had a Standard license but a Premium license was required because the Flows used Premium data connectors. 

So, even though part of the App was accessible to the user when navigated to directly, not all of the App was accessible.

This link How to check license designation for an app - Power Apps | Microsoft Docs indicates the issue.

App access and licensing permissions can be checked here: 

https://<domain>.dynamics.com/WebResources/msdyn_AppAccessChecker.html

[Tono_Analyst2]

Hi @faisalje, I've run into the issue you were facing. I figured it has to do with licensing also, although I thought it would be okay working in a developer environment (for testing purposes only).

Also, I don't understand why it works if we assign the system admin role to the user. They still don't have a premium license, so I would expect it to not work regardless of having a system admin or customizer role.

Any ideas?