SaaS

Microsoft Power Platform

Ploy shows who holds which security role in each of your Power Platform environments, and can give or remove those roles for you. Power Platform connects through your existing Microsoft integration: it uses the same Microsoft app, so there is nothing new to sign in with.

Power Platform is in beta. When you set it up you will be asked to tick a box agreeing that, for this connection, Ploy may record redacted copies of the error messages Microsoft sends back, so we can fix problems quickly. Redacted means names, email addresses and other personal details are removed before anything is stored.

What Ploy shows

  • Every Power Platform environment, as a resource.

  • In environments with Dataverse: each person's security roles, roles held through a team (shown as the team's group holding the role), and who is in those teams.

  • In environments without Dataverse: who is Environment Admin and Environment Maker.

People are matched to the accounts your Microsoft integration already shows, so nobody appears twice.

Before you start

  • The Microsoft integration must already be connected in Ploy.

  • You need to be a Power Platform administrator (or Global administrator) in Microsoft.

  • For each environment with Dataverse, you also need to be a System Administrator inside that environment (step 3 shows how to add yourself).

Step 1: Add Power Platform in Ploy

  1. In Ploy, go to Integrations and find your Microsoft connection.

  2. Open the ⋯ menu on its row and choose Add Microsoft Power Platform.

  3. Tick the beta acknowledgement. Leave the setup page open: it shows your Application (client) ID, the commands for step 2, and the Application ID to search for in step 3.

Step 2: Register Ploy's app with Power Platform

Microsoft has no screen for this step, so it is done with two commands in Azure Cloud Shell. Nothing needs installing.

  1. Open https://shell.azure.com, signed in as a Power Platform administrator of your organisation, and choose Bash.

  2. Copy the two lines from the Register the app box on Ploy's setup page and paste them into Cloud Shell.

  3. A reply starting HTTP/2 200 means the app is registered.

If Cloud Shell asks you to choose a subscription, press Enter. If you have access to more than one Microsoft organisation, check Cloud Shell is signed in to the one your Microsoft integration is connected to.

Step 3: Add the app to each environment with Dataverse

Do this once for every environment you want Ploy to see.

  1. Open the Power Platform admin centre (https://admin.powerplatform.microsoft.com) and go to Manage, then Environments, and choose the environment.

  2. Go to Settings, then Users + permissions, then Application users, and choose New app user.

  3. Choose Add an app and paste the Application ID from Ploy's setup page into the search box. The app is not listed until you search for it.

  4. Choose a business unit and a security role, then Create. Ploy needs to read users, roles and teams; System Administrator works, and so does a custom role with read access to those tables. To let Ploy give and remove roles, the role must also be allowed to assign roles.

If adding the app fails with a message mentioning a missing privilege, you are not yet a System Administrator inside this environment. On the environment's page choose Membership, then Add me, and try again.

An environment you skip is still listed in Ploy, but its roles are not shown.

Step 4: Test and save

Back in Ploy, choose Test, then Save. To let Ploy give and remove roles, turn on Allow Ploy to make changes before saving. It is off by default.

Giving and removing roles

With changes allowed, open an environment in Ploy:

  • Grant access gives a person a security role you choose. If they are not yet in the environment, Ploy adds them first. They need a Power Apps or Dynamics 365 licence.

  • Remove access removes the roles the person holds directly. Roles they hold through a team stay until they leave the team.

Good to know

  • Ploy does not disable or delete people in Power Platform: a person's access there follows their Microsoft account and licence.

  • Power Platform does not report when each person last signed in.

  • App and flow sharing are not shown yet.

Was this helpful?
Was this helpful?