Deploying the Power Platform COE with two accounts

[KayBains]

Hi

Has anyone used two accounts for deploying the CoE Starter kit for Power Platform?   I would like to know did you have any issues, and did it work as expected or if you have any guides

Due to compliance reasons, we have been advised the following: -

Use a mail enabled account which is only required for the Office 365 Outlook connection reference on import to send the emails. We do send emails to the admin as well via the Admin eMail env var so that one would also need to be set to something that can receive emails but does not have to match any connection references necessarily, so they can be different.

For all the other connection references like Power Apps for Admins, PA managements, etc… for those you would need the account with the appropriate admin rights i.e. a Service Account which has Admin access and not email enabled.

Off course these accounts will still have MFA so no one externally can log in, because it runs as a service once its authenticated it just carries on.

[HSheild · Accepted solution]

Hi @KayBains 

I’ve done this before with two different accounts due to a client’s security requirements around admin accounts. Install the CoE solutions as the admin account but when you create the connections for Outlook, Teams etc. use the email enabled non-admin account to log into these connections.

Alternatively, you can install the solutions as the non-admin account, set all connections to this account initially so you can complete the install, and then afterwards use the admin account to go and change all of the connection references to use its connections.

Hope that makes sense. 

[KayBains]

Thank you - this sounds an ideal solution

[KayBains]

Hi

Initially the CoE was installed  with an Admin Account which was mail enabled.

Then I  removed the email exhange license on the Admin Account, thus the Admin Account is not mail enabled

Recreated the Outlook connection with an email enabled non-admin account.

Now on running  the Admin | Sync Template v3,  an error  RetrievePrivilegeForUser: The user with id - non-admin mail enabled acount   has not been assigned any roles. They need a role with the prvReadadmin_Maker privilege

How can this be corrected

[HSheild]

Looks like the new non-admin user does not have any security roles assigned in your CoE environment.  You can set security roles in the Power Platform Admin Centre.

Here is a list of security roles that come with the CoE Starter Kit

Core components - Power Platform | Microsoft Docs