Power Platform Inventory

Tenant-level BAP access

What you get: environments list, DLP policies list. Without this tier the scan cannot proceed at all — the inventory result will show a prereq checklist instead of data.

What to grant:

1. Assign the Entra directory role Power Platform Administrator to the service principal. (Global Administrator also works but is more access than needed.)
2. Register the service principal with BAP as a tenant management app — one PowerShell command, run once per tenant.

Install-Module -Name Microsoft.PowerApps.Administration.PowerShell -Scope CurrentUser -Force
Add-PowerAppsAccount                         # sign in as a Global Administrator
New-PowerAppManagementApp -ApplicationId <YOUR_CLIENT_ID>

Why both: the directory role opens the door; the management-app registration lets app-only tokens through. Human users don’t need the management-app step because their delegated tokens already carry identity. Service principals do. This is Microsoft’s documented pattern — the same one the CoE Starter Kit uses. See Fix: Power Platform scan returns 0 flows + 0 apps for the full troubleshooting walk-through.

Token audience: https://service.powerapps.com/.default

Symptom when missing: the scan completes but the result shows “BAP access prerequisites missing” with the one-time setup checklist. Zero environments, zero DLP policies, zero flows, zero apps. Nothing to act on except the checklist.

Environment Admin on each environment

What you get: the flow list and app list for every environment where you grant this role. Without it, Tier 1 gives you environment names but the per-environment /flows and /powerApps endpoints return empty arrays.

What to grant (current path):

1. Open the Power Platform Admin Center.
2. Go to Environments, click into each environment you want inventoried.
3. Navigate to Settings → Users + permissions → Application users.
4. Click + New app user.
5. In App, search for the service principal by its Application (client) ID and select it.
6. In Business unit, leave the environment’s root business unit selected.
7. In Security roles, assign System Administrator. (Narrower custom roles work in production; see Tier 3 below.)
8. Click Create.

Why per-environment: Microsoft deliberately keeps environments autonomous. Having tenant-level Power Platform Admin lets you see that environments exist, but each environment owner decides who reads its contents. The per-env grant is what unlocks the flow and app enumeration endpoints.

Token audience: same as Tier 1 (https://service.powerapps.com/.default) — the authorization check is where this differs, not the audience.

Symptom when missing: the inventory shows environment and DLP counts correctly, but the Apps stat turns amber at 0 and a “Scan Diagnostics” panel appears with a message like “listApps returned 0 apps across N environments”. Flow details (connector references) also come back empty. Before the CDS 2.0 deprecation this symptom meant “run the old Environment Admin PowerShell grant”; today it means “create the Application User above.”

Application user per Dataverse environment

What you get: the Dataverse solution list for each environment (unique name, friendly name, version, managed or unmanaged, publisher). Environments with no Dataverse database are skipped cleanly.

What to grant:

1. Power Platform Admin Center → Environments → your env → Settings → Users + permissions → Application users.
2. Click + New app user.
3. Select the service principal’s app registration.
4. Assign a role that can read the solutions table. System Administrator works; a narrower custom role with Solution: Read is preferable in production.

Why this is a separate grant: Dataverse is its own identity plane. The BAP admin role doesn’t imply Dataverse access. Each Dataverse organization authorizes via its own role-based access and needs an explicit Application User record per service principal.

Token audience: {dataverseUrl}/.default — different per environment because the audience is the org’s own URL (e.g. https://contoso.crm.dynamics.com/.default). Our BAP client caches Dataverse tokens per URL so the overhead is one token per scan per env.

Symptom when missing: Solutions count is 0 for that specific environment. Other environments (where the grant is correct) still show solutions. No scan-wide failure.