Accidentally deleted System Administrator Security Role

[Kuehnel98]

Hello everyone,

This topic is really important for me/our company so any help is highly appreciated!

I played around assigning different security roles to users of a model-driven app. Unfortunately I removed the system administrator role from myself. Now there is no System admin anymore in this environment and we can't access or edit some of our apps. Assigning a new sys admin is not possible because only sys admin can do this. I already contacted our IT specialist with Global Admin rights for our Microsoft tenant but even he can not add the sys admin role to this environment.

This is quite urgent because it is our production environment. I did not know that you can remove the sys admin role when it is the last one in this environment. Hopefully we can "rescue" this environment...

Is there a way for me/any person in our company to regain sys admin rights for this environment? 

Thank you so much for your help!!

[Anonymous]

Hey!

Yes, it can be saved, but you need this AAD role assigned (Azure Active Directory), or someone that has it

Azure AD built-in roles - Azure Active Directory - Microsoft Entra | Microsoft Learn

then go to the admin site of power platform Power Platform admin center (microsoft.com) and assign someone that role

good luck!

[Kuehnel98]

Thanks for your help but I think I need some further specification.

I have the Azure AD Role "Power Platform Admin" assigned to myself. I still can not add the System Admin Security role in my Prod environment.

Just to be clear: I am referring to the Dataverse Security Role "System Administrator".

The Azure AD Roles are something different, right?

[Anonymous]

The AD role is supposed to allow you to change anything in the environment..

what happens if you go to the admin site https://admin.powerplatform.microsoft.com/environments open the environment settings, search for roles and then try to add yourself in the sys admin role?

[Kuehnel98]

When I try to add the sys admin role i get this error:

Failed to assign role 'System Administrator' : privilegeDenied (see Screenshot)

[Anonymous]

Can you try the following?

1. Find the environment URL and open it
   
2. click on settings and then "advance settings"
   
3. then go to users, find yourself and try to add the admin role from there

please let me know if that was possible

[Kuehnel98]

Unfortunately this does not work either 😞

[Anonymous · Accepted solution]

weird.... I just tested that in my testing tenant and is working...

can you double check you have the AD role assigned? is your company using PIM?

[Kuehnel98]

I also think that this is very strange... In the attached screenshot you can see that I have the AD role assigned.
I am not sure whether we use PIm or not, I dont think so.

Could it be the problem that I removed the sys admin role while sharing the model-driven app? So I removed the sys admin role in the Share a model-driven app window. I thought that it would only remove the sys admin role for this app (!) and not for the whole environment... I'm kind of frustrated at this stage.

But thank you already so much for your time and help! Much appreciated

[Anonymous]

ups, then the last resource would be a restore

Back up and restore environments - Power Platform | Microsoft Learn

have you tried it?