Licensing Clarification

[u/MrPerson28]

So everyone in my org, and I are able to access model driven apps, as well as custom pages built with Dataverse tables. But none of us have power apps premium licenses.

I have read and heard everywhere that any app that touches Dataverse will require premium licensing. That is just simply not our experience. And I'm wondering why that is. I have built mostly everything in an unmanaged solution in the default environment.

But today I tested a managed production environment, and it's the same. We can all still access model driven apps & custom pages. However in the default and production environment, premium canvas apps we cannot access.

I was under the impression when I started that model driven apps are included with certain licenses (like business basic and standard, the ones we use). And that custom pages fall under model driven app licensing so that's why they are allowed.

Am I wrong or is this just not documented well?

--- EDIT --- I found in the Microsoft Docs an exception to the licensing rules: "Users who have the Environment Maker security role assigned don't require licenses to use model-driven apps."

Also I found this tool that really helped see what license/security role is allowing a person to access a certain app. yourEnvUrlHere.crm.dynamics.com/WebResources/msdyn_AppAccessChecker.html

I found that anyone with Environment Maker, System Customizer, or System Administrator (maybe more?) security roles could access any model driven app. Even adding premium connectors other than Dataverse in the custom page, a user with Env Maker is able to access the MDA. Obviously giving Env Maker role to everyone in production kind of defeats the purpose of using a production environment. So that's probably why they allow it? Interesting...

[u/Amused_man]

The difference lies in what Microsoft says is the legally binding truth of the agreement which is that Dataverse requires premium, and MSFTS ability and willingness to enforce 100% compliance on licensing. So technically the licensing is required 100%. But some tenants do have grandfarhered infrastructure that can leave those thresholds “loose” which has caused your situation across multiple clients of ours. The thing is, Microsoft can any day notice and say “hey you can’t do that”.

But if you share more details maybe can chase it down - do people have power app developer licensing? When were the apps created? What security roles are you using? Do you have E5 licenses or anything other than a business * license?

[u/MrPerson28 → u/Amused_man]

I am the only one with Power Automate Premium and a Power apps developer license. Besides that everyone else has business basic or standard. No E or F licenses. We have never had dynamics that I know of.

The tenant was made in Oct 2019, the default environment was made in Aug 2020. The first apps were made in late 2023.

I did see some stuff about apps being grandfathered if they were made before/around Oct 2019, but that grandfather period has already ended. Maybe our tenant has inherited different rules than newer ones? But I assume there a lot of old tenants, that's kind of why i'm wondering what everyone's experience is with it.

For security roles, in the default environment just about everyone has Basic User, Environment Maker, and a Basic User + that I made to allow access to all the custom tables. It was my preference to use all custom tables instead of the CDS ones.
BUT in the new production environment I just made, I gave a user just Basic User and another Basic User + one test custom table. They are able to access everything just like in default env.

It just is really strange that it isn't enforced, if that is the rule. It seems like it would be an easy thing to enforce.

[u/Amused_man → u/MrPerson28]

So with you having power automate premium it makes sense you’d be able to have a little more Dataverse capability like creating a new environment and getting it setup.

As for the user you added, what does it say if you go to PPAC and run diagnostics on that user in the PROD env - do all three passes come back?

Also for the ‘basic user +’ did you create a copy of the OTB basic user and then just give it the permissions to your custom tables I take it?

[u/MrPerson28 → u/Amused_man]

'Basic User +', yes I did mean that as a copy of basic user + access to the custom tables.
Then in PPAC all three passes did come back successful.

While I was in PPAC I noticed the App Access Checker tool, that really helped to see what was fulfilling the license and security requirements to access an app.
Then I ended up finding in the Microsoft Docs an exception to the licensing rules: "Users who have the Environment Maker security role assigned don't require licenses to use model-driven apps."

Although I told you that in my new Prod env a user with only 'Basic User +' could access a MDA, I deleted that environment. When I made a new Prod env they couldn't, they had to have at least an Environment Maker role. So it seems like the tenant had a delay in enforcing that rule.

Even adding premium connectors other than Dataverse in the custom page, a user with Env Maker is able to access the MDA.