[CoE Starter Kit - BUG] Get Custom connectors failed

[Cathi029]

Does this bug already exist in our backlog?

• I have checked and confirm this is a new bug.

Describe the issue

Hi,
the action "Get Custom connectors as Admins" fails with the error:
The user with object id '....' in tenant '...' does not have access to permission 'ManageAnyCustomApi' in environment '....'. Error Code: 'PermissionBlockedByOfficeAI'.
The user runing the CoE Kit has the entra role Power Platform Admin. Which privileges are needed for the environments?

Kind regards
Caddy

Expected Behavior

No response

What solution are you experiencing the issue with?

Core

What solution version are you using?

December 2025

What app or flow are you having the issue with?

Admin | Sync Template v4 (Custom Connectors)

What method are you using to get inventory and telemetry?

Cloud flows

Steps To Reproduce

No response

Anything else?

No response

[harini-2-y]

Hi @Cathi029 ,
Thanks for reporting this issue.

You’re seeing this error because the environment has AI governance controls that block the ManageAnyCustomApi permission, even for Power Platform Admins. To resolve the issue, please follow one of the options below:

Option 1: Request an AI Governance Exception (Recommended)
Contact your Microsoft Tenant Admin or Global Administrator.
Request an exception for the CoE service account to access custom connectors in AI‑governed environments.
Provide justification such as: “Required for CoE inventory and governance.”
The administrator can configure this in the Power Platform Admin Center under the environment’s AI security / governance settings.

Option 2: Use an Alternative Service Account
Create a dedicated service account for the CoE Starter Kit.
Ensure this account is not blocked by AI governance policies.
Assign this account:
Power Platform Administrator role (Entra ID)
System Administrator role in each Dataverse environment
Update the CoE flow connections to use this new account.

Option 3: Exclude AI‑Governed Environments (Workaround)
If neither of the above is possible, you can exclude the affected environments from custom connector inventory:
Open the admin_environment table in your CoE Dataverse environment.
For the impacted environment, set admin_excusefrominventory = Yes.
The sync flow will skip this environment during inventory collection.
Keep track of excluded environments and review them periodically.

[Cathi029]

Hi, thanks you.
Could you explain a bit more in detail option 1. I can not find this setting in the environment setting. The mentioned service Account is Power Platform Admin, so with this account I should see all settings in the Power Platform Admin Center, right?

Kind regards
Caddy