[ALM Accelerator - QUESTION] QUESTION

[iamaninda93]

What is your question?

Question: When deploying a solution through ALM I am getting the below issue during the execution of the “Share Canvas app with AAD group” step in DevOps pipeline. In ALM accelerator Deployment configuration settings I pointed an AAD group in The Canvas app tab. My intention is to share the Canvas app with AAD group. Can you suggest a solution for the issue?   Error       : @{code=BusinessAppPlatformRequestFailed; message=The request failed with client error: 'The service               principal with id '15ce5dd2-3f37-4668-ba57-a9a01b7c9a1f' for application               does not have permission to access the path 'https://xy.0.8.xx:20127/               /providers/Microsoft.BusinessAppPlatform/scopes/service/environments/xxxxxxxxx-b3c5-yyyyyyyyy               /checkAccess?api-version=2016-11-01' in tenant .'. Code        : 403 Description : Forbidden Headers     : {Vary, Strict-Transport-Security, x-ms-islandgateway, Referrer-Policy...}

What component are you experiencing the issue with?

ALM Accelerator Canvas App

What solution version are you using?

1.0.20240305.1

AB#3788

[MaheshSripada]

Hi @iamaninda93,

Can you make sure the user is having the Environment Maker role in the target environment.

More Info: https://learn.microsoft.com/en-us/power-platform/guidance/alm-accelerator/setup-app-user-permissions#permissions-for-downstream-environments

cc - @RajeevPentyala

[iamaninda93]

@MaheshSripada

Do you want me to check the environment maker role for user or for the sp?

[iamaninda93]

@MaheshSripada I have given access to my id to qa environment. Given the system admin role and still getting same error.

the service principal does have system admin role too.

[MaheshSripada]

@iamaninda93 : Please give the Environment Maker role.