Maker Environment Request App - Least Privilege Security Principle

[kalpananirapure]

Does this bug already exist in our backlog?

• I have checked and confirm this is a new bug.

Describe the issue

Hi,

I have setup COE Started Kit using June 2024 build, everything is up and running.

Now I'm trying to apply Least Privilege Security Principle , for makers to only access the shared maker apps from COE Environment.

I've granted following SR to maker user

• Power Platform Maker SR
• Basic User --> If I do not provide this role, the user doesn't see the COE Env. in environment selector, the documentation of COE Kit should be updated to reflect this, unless I'm missing something.

Using above when I try with the maker user to request an Env. using Maker Env. request app, at last step I get network error stating I do not have sufficient permission.

What other permission should be applied, I do not want to give Environment Maker, I'm assuming with "Power Platform Maker SR" role should cover the required permission to underline tables.

What am I missing?

Expected Behavior

with only two min roles assigned to maker user

• Power Platform Maker SR
• Basic User

Maker user should be able to request Environment.

Lastly, when using M365 email enabled group which is linked to Teams in environment, the SR at teams level should automatically propagate to user, i shouldn't be setting the same permission on the user object again. Please indicate if I'm missing something and doing wroing. Nothing has been explicitly mentioned in documentation.

What solution are you experiencing the issue with?

Core

What solution version are you using?

4.32.2

What app or flow are you having the issue with?

Maker Environment Request

What method are you using to get inventory and telemetry?

None

Steps To Reproduce

No response

Anything else?

No response

AB#3800

[Jenefer-Monroe]

Hello, in our testing we don't grant the basic user SR as we just have the person use a link to the app rather than browse to the envt an find the app. Thats the goal with our SR.

If you want them to have access to the envt itself, for exaple the ability to browse the apps, then you will need to grant more SR's. Basic user is likely the correct one if thats your goal.

[Jenefer-Monroe]

Regarding this app, can you please share a screenshot with your specific issue?

[kalpananirapure]

Thanks for prompt response. Please find the issue i'm facing while making an environment request

SR Assigned

maker-powerplatform (M365 email enabled group) -->

• Member --> Pradeep Gupta
• SR
• Power Platform Maker SR
• Basic User

Note:

• No explicit SR have been given to pradeep gupta user object.
• Environment such as Developer Trial, Production has been disabled for all users and only allowed to Admins - Setting is on.

Please find the view below when Pradeep Gupta tries to request new environment using the Maker app

[kalpananirapure]

I see this error on network

{
"error": {
"code": "0x80040220",
"message": "Principal user (Id=66dc27bd-583b-ef11-8409-000d3ab943ae, type=8, roleCount=2, privilegeCount=1048, accessMode='0 Read-Write', AADObjectId='9631f464-f499-4747-bace-5ae21a454818', MetadataCachePrivilegesCount=5381, businessUnitId=10b4dec8-1225-ef11-840b-000d3aba3b02), is missing prvAppendToUser privilege (Id=3399e6d2-dd3c-4a14-8433-39c1eca27aaa) on OTC=8 for entity 'systemuser' (LocalizedName='User'). context.Caller=66dc27bd-583b-ef11-8409-000d3ab943ae. Consider adding missed privilege to one of the principal (user/team) roles.",
"@Microsoft.PowerApps.CDS.ErrorDetails.ApiExceptionSourceKey": "Plugin/Microsoft.Crm.ObjectModel.CustomBusinessEntityService",
"@Microsoft.PowerApps.CDS.ErrorDetails.ApiStepKey": "1e8820f5-7d29-ef11-840c-000d3aba330a",
"@Microsoft.PowerApps.CDS.ErrorDetails.ApiDepthKey": "1",
"@Microsoft.PowerApps.CDS.ErrorDetails.ApiActivityIdKey": "aafd0749-8ee2-4bc0-9d73-88952c739bb3",
"@Microsoft.PowerApps.CDS.ErrorDetails.ApiPluginSolutionNameKey": "System",
"@Microsoft.PowerApps.CDS.ErrorDetails.ApiStepSolutionNameKey": "System",
"@Microsoft.PowerApps.CDS.ErrorDetails.ApiExceptionCategory": "ClientError",
"@Microsoft.PowerApps.CDS.ErrorDetails.ApiExceptionMessageName": "PrivilegeDenied",
"@Microsoft.PowerApps.CDS.ErrorDetails.ApiExceptionHttpStatusCode": "403",
"@Microsoft.PowerApps.CDS.ErrorDetails.0": "prvAppendToUser",
"@Microsoft.PowerApps.CDS.ErrorDetails.1": "User",
"@Microsoft.PowerApps.CDS.ErrorDetails.2": "user",
"@Microsoft.PowerApps.CDS.ErrorDetails.3": "66dc27bd-583b-ef11-8409-000d3ab943ae",
"@Microsoft.PowerApps.CDS.ErrorDetails.4": "8",
"@Microsoft.PowerApps.CDS.ErrorDetails.5": "Caller",
"@Microsoft.PowerApps.CDS.HelpLink": "http://go.microsoft.com/fwlink/?LinkID=398563&error=Microsoft.Crm.CrmException%3a80040220&client=platform",
"@Microsoft.PowerApps.CDS.InnerError.Message": "Principal user (Id=66dc27bd-583b-ef11-8409-000d3ab943ae, type=8, roleCount=2, privilegeCount=1048, accessMode='0 Read-Write', AADObjectId='9631f464-f499-4747-bace-5ae21a454818', MetadataCachePrivilegesCount=5381, businessUnitId=10b4dec8-1225-ef11-840b-000d3aba3b02), is missing prvAppendToUser privilege (Id=3399e6d2-dd3c-4a14-8433-39c1eca27aaa) on OTC=8 for entity 'systemuser' (LocalizedName='User'). context.Caller=66dc27bd-583b-ef11-8409-000d3ab943ae. Consider adding missed privilege to one of the principal (user/team) roles."
}
}

[Jenefer-Monroe]

To area owner for investigation.

[Zkemp26]

+1 to this as we are experiencing this problem in our COE environment. Maker granted proper SR and Maker Command Center allows Maker SR to access the app. Unable to submit Environment requests without also providing basic user SR alongside.

[Jenefer-Monroe]

I went ahead and fixed this one for August myself.

Here is the fix if you want to patch locally

[kalpananirapure]

The default "Members Privilege inheritance" is set to "Teams" in June release. has that changed in July/Upcoming August release?

Shall I change that to "Direct User + Teams" ???

[kalpananirapure]

Changing to "Direct User + Teams" and setting the AppendTo = Organization for User Table fixes the issue. The Makers are now able to request environment

[Jenefer-Monroe]

fixed in August release https://github.com/microsoft/coe-starter-kit/releases/tag/CoEStarterKit-August2024