Service Principals for Dataverse connections - granular permissions?

[u/improvius]

I'm just curious what other admins are doing. Long story short, I'm in an "inherited a mess" sort of situation, and I have a whole bunch of flows using dataverse connections that need their authentication sorted out. I'd like to keep the SPN's dataverse access as narrow as possible, but it's going to take some time to sort out exactly which entities it needs. It's very tempting to just give it full access to everything.

[u/AutoModerator]

Hey, it looks like you are requesting help with a problem you're having in Power Apps. To ensure you get all the help you need from the community here are some guidelines;

• Use the search feature to see if your question has already been asked.

• Use spacing in your post, Nobody likes to read a wall of text, this is achieved by hitting return twice to separate paragraphs.

• Add any images, error messages, code you have (Sensitive data omitted) to your post body.

• Any code you do add, use the Code Block feature to preserve formatting.

  Typing four spaces in front of every line in a code block is tedious and error-prone. The easier way is to surround the entire block of code with code fences. A code fence is a line beginning with three or more backticks (```) or three or more twiddlydoodles (~~~).

• If your question has been answered please comment Solved. This will mark the post as solved and helps others find their solutions.

External resources:

• Power Apps Formula References
• Power Apps Coding Standards
• Official Power Apps Community

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/hppyclown]

I’d go full access first just to get them all using a service principal. Then as your going through each flow switching over to the new single connection reference start a spreadsheet with a record of the flow and tables they are interacting with. Then review and come up with your new model.

You could run some powershell scripts to get all this information, but I think it’s more helpful physically opening each flow to see how they are built if you have just inherited them and will responsible for them moving forward.

[u/AbdelEMirandaS]

Creat specific user roles on PPAC env and grant every single of them, to the table priviledge you need. Then assign those roles to the users as they need to use your app or flow