Add Power Platform User SR and Maker SR to app module role assignments

CenterofExcellenceCoreComponents/SolutionPackage/src/AppModules/admin_CoEAdminCommandCenter/AppModule.xml

@@ -26,6 +26,7 @@
   <AppModuleRoleMaps>
     <Role id="{1d04a95b-cc80-e911-a82e-000d3a11eb35}" />
     <Role id="{3e6126b5-2589-e911-a856-000d3a372932}" />
+    <Role id="{0173e729-2b89-e911-a856-000d3a372932}" />
     <Role id="{627090ff-40a3-4053-8790-584edc5be201}" />
     <Role id="{119f245c-3cc8-4b62-b31c-d1a046ced15d}" />
   </AppModuleRoleMaps>

CenterofExcellenceCoreComponents/SolutionPackage/src/AppModules/admin_CoEAdminCommandCenter/AppModule_managed.xml

@@ -26,6 +26,7 @@
   <AppModuleRoleMaps>
     <Role id="{1d04a95b-cc80-e911-a82e-000d3a11eb35}" />
     <Role id="{3e6126b5-2589-e911-a856-000d3a372932}" />
+    <Role id="{0173e729-2b89-e911-a856-000d3a372932}" />
     <Role id="{627090ff-40a3-4053-8790-584edc5be201}" />
     <Role id="{119f245c-3cc8-4b62-b31c-d1a046ced15d}" />
   </AppModuleRoleMaps>

CenterofExcellenceCoreComponents/SolutionPackage/src/AppModules/admin_CoEMakerCommandCenter/AppModule.xml

@@ -15,6 +15,7 @@
   <AppModuleRoleMaps>
     <Role id="{1d04a95b-cc80-e911-a82e-000d3a11eb35}" />
     <Role id="{3e6126b5-2589-e911-a856-000d3a372932}" />
+    <Role id="{0173e729-2b89-e911-a856-000d3a372932}" />
     <Role id="{627090ff-40a3-4053-8790-584edc5be201}" />
     <Role id="{119f245c-3cc8-4b62-b31c-d1a046ced15d}" />
   </AppModuleRoleMaps>

CenterofExcellenceCoreComponents/SolutionPackage/src/AppModules/admin_CoEMakerCommandCenter/AppModule_managed.xml

@@ -15,6 +15,7 @@
   <AppModuleRoleMaps>
     <Role id="{1d04a95b-cc80-e911-a82e-000d3a11eb35}" />
     <Role id="{3e6126b5-2589-e911-a856-000d3a372932}" />
+    <Role id="{0173e729-2b89-e911-a856-000d3a372932}" />
     <Role id="{627090ff-40a3-4053-8790-584edc5be201}" />
     <Role id="{119f245c-3cc8-4b62-b31c-d1a046ced15d}" />
   </AppModuleRoleMaps>

CenterofExcellenceCoreComponents/SolutionPackage/src/AppModules/admin_PowerPlatformAdminView/AppModule.xml

@@ -154,6 +154,8 @@
   </AppModuleComponents>
   <AppModuleRoleMaps>
     <Role id="{1d04a95b-cc80-e911-a82e-000d3a11eb35}" />
+    <Role id="{3e6126b5-2589-e911-a856-000d3a372932}" />
+    <Role id="{0173e729-2b89-e911-a856-000d3a372932}" />
     <Role id="{627090ff-40a3-4053-8790-584edc5be201}" />
     <Role id="{119f245c-3cc8-4b62-b31c-d1a046ced15d}" />
   </AppModuleRoleMaps>

CenterofExcellenceCoreComponents/SolutionPackage/src/AppModules/admin_PowerPlatformAdminView/AppModule_managed.xml

@@ -154,6 +154,8 @@
   </AppModuleComponents>
   <AppModuleRoleMaps>
     <Role id="{1d04a95b-cc80-e911-a82e-000d3a11eb35}" />
+    <Role id="{3e6126b5-2589-e911-a856-000d3a372932}" />
+    <Role id="{0173e729-2b89-e911-a856-000d3a372932}" />
     <Role id="{627090ff-40a3-4053-8790-584edc5be201}" />
     <Role id="{119f245c-3cc8-4b62-b31c-d1a046ced15d}" />
   </AppModuleRoleMaps>

docs/CHANGES.md

@@ -0,0 +1,163 @@
+# Security Role Assignment Changes
+
+## Summary of Changes
+
+This document details the changes made to fix the issue where Power Platform User SR and Maker SR security roles were not visible when sharing CoE Starter Kit apps.
+
+## Problem
+
+Users could not see the **Power Platform User SR** or **Power Platform Maker SR** roles when attempting to share model-driven apps in the CoE Starter Kit. Only high-privilege roles (System Administrator, System Customizer, Power Platform Admin SR) were visible in the sharing dialog.
+
+## Root Cause
+
+Model-driven apps in Power Platform only display security roles in the sharing dialog if those roles are explicitly assigned to the app module. The Power Platform User SR and Maker SR roles existed in the solution with proper privileges but were not assigned to the app modules.
+
+## Solution
+
+Added the missing security role IDs to the AppModuleRoleMaps section of affected app modules:
+
+- **Power Platform Admin SR**: `{1d04a95b-cc80-e911-a82e-000d3a11eb35}` ✓ (already assigned)
+- **Power Platform Maker SR**: `{3e6126b5-2589-e911-a856-000d3a372932}` ✓ (added where missing)
+- **Power Platform User SR**: `{0173e729-2b89-e911-a856-000d3a372932}` ✓ (added to all)
+
+## Apps Modified
+
+### 1. Power Platform Admin View (admin_PowerPlatformAdminView)
+
+**Before:**
+```xml
+<AppModuleRoleMaps>
+  <Role id="{1d04a95b-cc80-e911-a82e-000d3a11eb35}" /> <!-- Admin SR -->
+  <Role id="{627090ff-40a3-4053-8790-584edc5be201}" /> <!-- System Administrator -->
+  <Role id="{119f245c-3cc8-4b62-b31c-d1a046ced15d}" /> <!-- System Customizer -->
+</AppModuleRoleMaps>
+```
+
+**After:**
+```xml
+<AppModuleRoleMaps>
+  <Role id="{1d04a95b-cc80-e911-a82e-000d3a11eb35}" /> <!-- Admin SR -->
+  <Role id="{3e6126b5-2589-e911-a856-000d3a372932}" /> <!-- Maker SR ✓ ADDED -->
+  <Role id="{0173e729-2b89-e911-a856-000d3a372932}" /> <!-- User SR ✓ ADDED -->
+  <Role id="{627090ff-40a3-4053-8790-584edc5be201}" /> <!-- System Administrator -->
+  <Role id="{119f245c-3cc8-4b62-b31c-d1a046ced15d}" /> <!-- System Customizer -->
+</AppModuleRoleMaps>
+```
+
+### 2. CoE Admin Command Center (admin_CoEAdminCommandCenter)
+
+**Before:**
+```xml
+<AppModuleRoleMaps>
+  <Role id="{1d04a95b-cc80-e911-a82e-000d3a11eb35}" /> <!-- Admin SR -->
+  <Role id="{3e6126b5-2589-e911-a856-000d3a372932}" /> <!-- Maker SR -->
+  <Role id="{627090ff-40a3-4053-8790-584edc5be201}" /> <!-- System Administrator -->
+  <Role id="{119f245c-3cc8-4b62-b31c-d1a046ced15d}" /> <!-- System Customizer -->
+</AppModuleRoleMaps>
+```
+
+**After:**
+```xml
+<AppModuleRoleMaps>
+  <Role id="{1d04a95b-cc80-e911-a82e-000d3a11eb35}" /> <!-- Admin SR -->
+  <Role id="{3e6126b5-2589-e911-a856-000d3a372932}" /> <!-- Maker SR -->
+  <Role id="{0173e729-2b89-e911-a856-000d3a372932}" /> <!-- User SR ✓ ADDED -->
+  <Role id="{627090ff-40a3-4053-8790-584edc5be201}" /> <!-- System Administrator -->
+  <Role id="{119f245c-3cc8-4b62-b31c-d1a046ced15d}" /> <!-- System Customizer -->
+</AppModuleRoleMaps>
+```
+
+### 3. CoE Maker Command Center (admin_CoEMakerCommandCenter)
+
+**Before:**
+```xml
+<AppModuleRoleMaps>
+  <Role id="{1d04a95b-cc80-e911-a82e-000d3a11eb35}" /> <!-- Admin SR -->
+  <Role id="{3e6126b5-2589-e911-a856-000d3a372932}" /> <!-- Maker SR -->
+  <Role id="{627090ff-40a3-4053-8790-584edc5be201}" /> <!-- System Administrator -->
+  <Role id="{119f245c-3cc8-4b62-b31c-d1a046ced15d}" /> <!-- System Customizer -->
+</AppModuleRoleMaps>
+```
+
+**After:**
+```xml
+<AppModuleRoleMaps>
+  <Role id="{1d04a95b-cc80-e911-a82e-000d3a11eb35}" /> <!-- Admin SR -->
+  <Role id="{3e6126b5-2589-e911-a856-000d3a372932}" /> <!-- Maker SR -->
+  <Role id="{0173e729-2b89-e911-a856-000d3a372932}" /> <!-- User SR ✓ ADDED -->
+  <Role id="{627090ff-40a3-4053-8790-584edc5be201}" /> <!-- System Administrator -->
+  <Role id="{119f245c-3cc8-4b62-b31c-d1a046ced15d}" /> <!-- System Customizer -->
+</AppModuleRoleMaps>
+```
+
+## Files Changed
+
+### AppModule XML Files (Unmanaged)
+- `CenterofExcellenceCoreComponents/SolutionPackage/src/AppModules/admin_PowerPlatformAdminView/AppModule.xml`
+- `CenterofExcellenceCoreComponents/SolutionPackage/src/AppModules/admin_CoEAdminCommandCenter/AppModule.xml`
+- `CenterofExcellenceCoreComponents/SolutionPackage/src/AppModules/admin_CoEMakerCommandCenter/AppModule.xml`
+
+### AppModule XML Files (Managed)
+- `CenterofExcellenceCoreComponents/SolutionPackage/src/AppModules/admin_PowerPlatformAdminView/AppModule_managed.xml`
+- `CenterofExcellenceCoreComponents/SolutionPackage/src/AppModules/admin_CoEAdminCommandCenter/AppModule_managed.xml`
+- `CenterofExcellenceCoreComponents/SolutionPackage/src/AppModules/admin_CoEMakerCommandCenter/AppModule_managed.xml`
+
+### New Documentation
+- `docs/README.md` - Documentation directory index
+- `docs/security-roles.md` - Comprehensive guide to security roles and app access
+
+## Impact
+
+### Positive Impact
+- Users can now grant view-only access using the Power Platform User SR role
+- Users can grant maker/contributor access using the Power Platform Maker SR role
+- Improved alignment with principle of least privilege
+- Better security model for CoE Starter Kit deployments
+
+### No Breaking Changes
+- Existing role assignments remain unchanged
+- No impact on current users or permissions
+- Backward compatible with existing installations
+- Adding roles to app modules is a non-breaking change
+
+## Testing Recommendations
+
+1. **Upgrade Test**
+   - Install or upgrade to the updated solution
+   - Verify all three security roles appear in app sharing dialogs
+   - Confirm existing permissions are not affected
+
+2. **Permission Test**
+   - Assign Power Platform User SR to a test user
+   - Share Power Platform Admin View with that user
+   - Verify user can view data but cannot modify/delete
+
+3. **Maker Test**
+   - Assign Power Platform Maker SR to a test user
+   - Share apps with that user
+   - Verify appropriate create/edit permissions
+
+## Security Role Privileges Summary
+
+### Power Platform User SR (View-Only)
+- **Read**: Global read access to all CoE custom tables
+- **Write**: Limited to notes and feedback only
+- **Create/Delete**: Very limited, notes only
+- **Ideal for**: Executives, stakeholders, auditors
+
+### Power Platform Maker SR (Contributor)
+- **Read**: Global read access to all CoE tables
+- **Write**: Can submit requests and update own records
+- **Create**: Can create approval requests and feedback
+- **Ideal for**: Makers, app creators, flow developers
+
+### Power Platform Admin SR (Full Access)
+- **Read/Write/Create/Delete**: Full access to all CoE tables
+- **Configure**: Can modify environment variables and settings
+- **Ideal for**: CoE administrators, platform admins
+
+## References
+
+- Issue: "How to Grant View Access to Power Platform CoE Toolkit Model driven apps"
+- [Security Roles Documentation](./security-roles.md)
+- [CoE Starter Kit Official Docs](https://learn.microsoft.com/power-platform/guidance/coe/starter-kit)

docs/README.md

@@ -0,0 +1,16 @@
+# CoE Starter Kit Documentation
+
+This directory contains supplementary documentation for the CoE Starter Kit.
+
+## Contents
+
+- [security-roles.md](security-roles.md) - Guide to security roles and app access in the CoE Starter Kit
+
+## Official Documentation
+
+The primary documentation for the CoE Starter Kit is maintained on Microsoft Learn:
+- [CoE Starter Kit Overview](https://learn.microsoft.com/power-platform/guidance/coe/starter-kit)
+
+## Contributing
+
+If you have suggestions for improving this documentation, please submit a pull request or open an issue.

docs/security-roles.md

@@ -0,0 +1,145 @@
+# Security Roles and App Access in CoE Starter Kit
+
+## Overview
+
+The CoE Starter Kit includes three predefined security roles that control access to the model-driven apps and data within the solution:
+
+1. **Power Platform Admin SR** - Full administrative access
+2. **Power Platform Maker SR** - Access for makers/contributors
+3. **Power Platform User SR** - Read-only/view access
+
+## Security Roles Explained
+
+### Power Platform Admin SR
+- **Purpose**: Full administrative access to all CoE apps and data
+- **Use Case**: CoE administrators who manage the CoE environment, configure flows, and have full CRUD operations on all tables
+- **Assigned to Apps**:
+  - Power Platform Admin View
+  - CoE Admin Command Center
+  - CoE Maker Command Center
+  - DLP Impact Analysis
+  - Manage Permissions
+  - Setup Wizard
+  - Environment Request
+
+### Power Platform Maker SR
+- **Purpose**: Access for makers and contributors who need to interact with approval workflows and submission processes
+- **Use Case**: Makers who submit requests for environments, custom connectors, or chatbots; can view CoE data but with limited modification rights
+- **Assigned to Apps**:
+  - CoE Admin Command Center
+  - CoE Maker Command Center
+
+### Power Platform User SR
+- **Purpose**: Read-only access to view CoE data
+- **Use Case**: Business users, leadership, or stakeholders who need to view Power Platform inventory and analytics without making changes
+- **Permissions**: Global read access to CoE tables, limited write access only for notes and feedback
+- **Assigned to Apps**:
+  - Power Platform Admin View
+  - CoE Admin Command Center  
+  - CoE Maker Command Center
+
+## How to Grant Access to CoE Apps
+
+### Granting View-Only Access
+
+To grant **view-only access** to users (e.g., for the Power Platform Admin View app):
+
+1. Navigate to the CoE environment in Power Platform Admin Center
+2. Go to **Settings** > **Users + permissions** > **Users**
+3. Select the user you want to grant access to
+4. Click **Manage roles** or **Manage security roles**
+5. Assign the **Power Platform User SR** role
+6. Navigate to the app (e.g., Power Platform Admin View)
+7. Click **Share** on the app
+8. Add the user and select the **Power Platform User SR** role
+9. Click **Share**
+
+### Granting Maker Access
+
+To grant **maker/contributor access**:
+
+1. Follow steps 1-3 above
+2. Assign the **Power Platform Maker SR** role
+3. Share the appropriate app with the **Power Platform Maker SR** role
+
+### Granting Admin Access
+
+To grant **full administrative access**:
+
+1. Follow steps 1-3 above
+2. Assign the **Power Platform Admin SR** role
+3. Share the appropriate app with the **Power Platform Admin SR** role
+
+## Why Can't I See Certain Security Roles When Sharing Apps?
+
+When you share a model-driven app in Power Platform, **only security roles that are assigned to that app module** will appear in the sharing dialog.
+
+If you don't see the Power Platform User SR or Power Platform Maker SR roles when trying to share an app:
+
+1. The role is not assigned to the app module in the solution
+2. The role doesn't exist in your environment (solution may not be fully installed)
+3. You need to assign the role to the app module first
+
+## App Module Security Role Assignments
+
+The following table shows which security roles are assigned to each app by default:
+
+| App Name | Admin SR | Maker SR | User SR | System Admin | System Customizer |
+|----------|----------|----------|---------|--------------|-------------------|
+| Power Platform Admin View | ✓ | ✓ | ✓ | ✓ | ✓ |
+| CoE Admin Command Center | ✓ | ✓ | ✓ | ✓ | ✓ |
+| CoE Maker Command Center | ✓ | ✓ | ✓ | ✓ | ✓ |
+| DLP Impact Analysis | ✓ | | | ✓ | ✓ |
+| Manage Permissions | ✓ | | | ✓ | ✓ |
+| Setup Wizard | ✓ | | | ✓ | ✓ |
+| App Catalog | | | | ✓ | ✓ |
+
+## Custom Security Roles
+
+If you create custom security roles in the CoE environment, they **will not automatically appear** in the app sharing dialog unless you:
+
+1. Manually add them to the app module definition, OR
+2. Share the app with users who have that role and manually configure the role assignment
+
+For production use, it's recommended to use the predefined CoE security roles (Admin SR, Maker SR, User SR) rather than creating custom roles, as they are:
+- Properly configured with the required privileges
+- Maintained and updated with solution upgrades
+- Designed to work with the CoE app security model
+
+## Troubleshooting
+
+### I assigned a user a security role but they can't see the app
+
+**Solution**: Make sure you both:
+1. Assigned the security role to the user in the environment
+2. Shared the app with the user using that security role
+
+Both steps are required for model-driven apps.
+
+### The Power Platform User SR role doesn't appear when sharing
+
+**Solution**: 
+- Ensure the CoE Core Components solution is fully installed
+- Check that the security role exists in your environment (Settings > Security > Security Roles)
+- Verify the role is assigned to the app module (this should be automatic with the updated solution)
+
+### Users see "You do not have permissions" errors
+
+**Solution**: 
+- Verify the user has the correct security role assigned
+- Check that the role has the necessary table privileges
+- Ensure the user has been shared the app with that security role
+- Wait a few minutes for permission changes to propagate
+
+## Best Practices
+
+1. **Use the predefined roles**: Use Power Platform Admin SR, Maker SR, and User SR rather than creating custom roles
+2. **Principle of least privilege**: Grant users the minimum access level they need (User SR for view-only, Maker SR for contributors, Admin SR only for administrators)
+3. **Regular access reviews**: Periodically review who has access to CoE apps and their assigned roles
+4. **Document custom changes**: If you modify security roles or create custom ones, document what was changed and why
+
+## References
+
+- [CoE Starter Kit Documentation](https://learn.microsoft.com/power-platform/guidance/coe/starter-kit)
+- [Model-Driven App Security](https://learn.microsoft.com/power-apps/maker/model-driven-apps/app-visibility-access)
+- [Security Roles and Privileges](https://learn.microsoft.com/power-platform/admin/security-roles-privileges)