Power Platform Inventory

Tenant-level BAP access

What you get: environments list, DLP policies list. Without this tier the scan cannot proceed at all — the inventory result will show a prereq checklist instead of data.

What to grant:

1. Assign the Entra directory role Power Platform Administrator to the service principal. (Global Administrator also works but is more access than needed.)
2. Register the service principal with BAP as a tenant management app — one PowerShell command, run once per tenant.

Install-Module -Name Microsoft.PowerApps.Administration.PowerShell -Scope CurrentUser -Force
Add-PowerAppsAccount                         # sign in as a Global Administrator
New-PowerAppManagementApp -ApplicationId <YOUR_CLIENT_ID>

Why both: the directory role opens the door; the management-app registration lets app-only tokens through. Human users don’t need the management-app step because their delegated tokens already carry identity. Service principals do. This is Microsoft’s documented pattern — the same one the CoE Starter Kit uses. See Fix: Power Platform scan returns 0 flows + 0 apps for the full troubleshooting walk-through.

Token audience: https://service.powerapps.com/.default

Symptom when missing: the scan completes but the result shows “BAP access prerequisites missing” with the one-time setup checklist. Zero environments, zero DLP policies, zero flows, zero apps. Nothing to act on except the checklist.

Environment Admin on each environment

What you get: the flow list and app list for every environment where you grant this role. Without it, Tier 1 gives you environment names but the per-environment /flows and /powerApps endpoints return empty arrays.

What to grant:

1. Open the Power Platform Admin Center.
2. Go to Environments, click each environment you want inventoried.
3. Under Access → Environment Admin, click Edit and add the service principal’s Application (client) ID.
4. Allow up to one hour for the role assignment to propagate.

Why per-environment: Microsoft deliberately keeps environments autonomous. Having tenant-level Power Platform Admin lets you see that environments exist, but each environment owner decides who reads its contents. The per-env admin role is what unlocks the flow and app enumeration endpoints.

Token audience: same as Tier 1 (https://service.powerapps.com/.default) — the authorization check is where this differs, not the audience.

Symptom when missing: the inventory shows environment and DLP counts correctly, but the Apps stat turns amber at 0 and a “Scan Diagnostics” panel appears with a message like “listApps returned 0 apps across N environments. Typical cause: the service principal has Power Platform Administrator but is not Environment Admin on each environment”. Flow details (connector references) may also be partial.

Application user per Dataverse environment

What you get: the Dataverse solution list for each environment (unique name, friendly name, version, managed or unmanaged, publisher). Environments with no Dataverse database are skipped cleanly.

What to grant:

1. Power Platform Admin Center → Environments → your env → Settings → Users + permissions → Application users.
2. Click + New app user.
3. Select the service principal’s app registration.
4. Assign a role that can read the solutions table. System Administrator works; a narrower custom role with Solution: Read is preferable in production.

Why this is a separate grant: Dataverse is its own identity plane. The BAP admin role doesn’t imply Dataverse access. Each Dataverse organization authorises via its own role-based access and needs an explicit Application User record per service principal.

Token audience: {dataverseUrl}/.default — different per environment because the audience is the org’s own URL (e.g. https://contoso.crm.dynamics.com/.default). Our BAP client caches Dataverse tokens per URL so the overhead is one token per scan per env.

Symptom when missing: Solutions count is 0 for that specific environment. Other environments (where the grant is correct) still show solutions. No scan-wide failure.