ALM Accelerator Setup & Admin Requirements for Microsoft Power Platform

by HubSite 365 about Something Awesome About … dynamics, crm, ce, power apps, business apps…

Pro UserPower PlatformPower SetupM365 Hot News

Explore Microsoft Power Platform Admin roles superpowers and risks of app elevation permissions for ALM accelerator setup.

Managing Power Platform with ALM Accelerator

ALM Accelerator is a feature introduced to Microsoft's Power Platform that allows management permissions. Recently, development teams have been struggling with the setup and configuration of this feature following the steps outlined in a Microsoft article.

One main step in the process is App registration. This requires certain elevated permissions like those of a Power Platform Admin. However, this has caused potential issues due to differing security policies across organizations.

Some of these elevated permissions may not be allowed by certain company policies, which can lead to malfunctioning of the ALM Accelerator.

Trouble with Elevated Permissions

The Power Platform management role is executed by users with the admin role, where they get to manage multiple environments. These users have the system administrator role across all Power platform environments within the M365 tenant. They are granted the power to sign in and manage all environments, regardless of security groups and can also perform admin functions in the platform. Follow this link for more information on Platform role Superpower.

However, the risk with these elevated permissions is that the crucial information such as Client ID and Secret can get stolen, which can be used to impersonate the Power Platform Admin. The risk of such impersonation attempts includes unauthorized management of apps, environments, including their creation and deletion.

Dealing with Elevated Permission Risks

The Power Platform Admin role comes with the power to limit the distribution of elevated permissions. The admins are generally interested in understanding what it implies when an app does not have the requested permissions.

On ensuing dissatisfaction on the available outcomes, Microsoft team supporting ALM preview was contacted who explained the scenario as a 'gap in functionality'. They added that without these permissions, certain functions like Canvas App Sharing might fail, although it wouldn't affect the deployment. Certain pipeline functions were also listed including, canvas apps, updating canvas app owner, running test automation, etc., that require such permissions.

Overview and Future Solutions

The ALM Accelerator for the Power platform offers multiple powerful capabilities but the need for elevated permissions presents security risks. It is critical to carefully evaluate the risks and benefits of granting such permissions. Meanwhile, Microsoft acknowledges the issue as a part of the platform's limitations and is likely to make improvements in the future. Strict measures to safeguard sensitive information and limiting elevated permissions would be steps in the right direction.

Read the full article Set up ALM accelerator for Microsoft Power Platform. Power Platform Admin requirements consideration

Power Platform - ALM Accelerator Setup & Admin Requirements for Microsoft Power Platform

Learn about Set up ALM accelerator for Microsoft Power Platform. Power Platform Admin requirements consideration

Configuring the ALM accelerator for Microsoft's Power Platform necessitates adequate comprehension of admin requirements. However, some hurdles arise in the operational process. When your client's operations team receives a request for ALM accelerator setup and configuration, they typically follow a set of instructions from Microsoft's official articles. The process involves an app registration, a step that requires Power App Management Permission.

Power Platform Admin Role Explained

People granted the Power Platform admin role have the authority to sign in and maintain multiple environments, perform admin functions across the Power Platform, and are not constrained by a security group. In addition, Power Platform admins can administrate environments without membership in any of a given environment's security group. They play a role akin to System Administrators across all Power Platform environments pertaining to your M365 tenant.

Potent Risks Involved

One significant risk is the potential theft of the Client ID and Secret. If stolen, these can be used to imitate the Power Platform Admin, a situation with serious consequences. An impersonator with admin privilege could manage apps and automation, as well as oversee environments, up to and including their creation and deletion.

The Desired Outcome

An optimal outcome would involve limiting the propagation of elevated permissions for a Power Platform Admin. Furthermore, it's important to understand the repercussions of denying the requested permissions to the app.

Current Possible Outcomes

Upon consulting with Microsoft's ALM preview support team, some gaps in platform functionality were revealed. Without the necessary permissions, Canvas App Sharing will fail to work properly, although the pipeline won't fail during deployment. The current workaround is to manually share apps in the downstream environment, an outcome not widely beloved. Among the pipeline functions needing these permissions are updating canvas app owners on import of an unmanaged solution, sharing canvas apps in downstream environments, and running canvas test automation where needed.

Ultimately, learning more about Power Platform admin requirements is crucial for efficient and secure operations. Proper management and understanding of these requirements enable you to minimize potential risks and ensure the successful execution of tasks.

Keywords

Microsoft Power Platform setup, ALM accelerator, Power Platform Admin requirements, Microsoft Power Platform ALM, Setup ALM accelerator, Power Platform accelerator, Microsoft ALM setup, Power Platform Admin setup, ALM accelerator requirements, Microsoft Power Platform Admin.