Assigning Security Roles for Power Platform Testing Access
Short answer
D Assign the new tester the Quality Assurance security role to grant the necessary Dataverse permissions for testing the Operations app.
Question
To answer the case study questions, you will need to reference information that is provided in the case. Case studies and associated questions might contain exhibits or other resources that provide more information about the scenario described in the case. Information provided in an individual question does not apply to the other questions in the case study.
A Review Screen will appear at the end of this case study. From the Review Screen, you can review and change your answers before you move to the next exam section. After you leave this case study, you will NOT be able to return to it.
To start the case study
To display the first question in this case study, select the “Next” button. To the left of the question, a menu provides links to information such as business requirements, the existing environment, and problem statements. Please read through all this information before answering any questions. When you are ready to answer a question, select the “Question” button to return to the question.
Background
Contoso Ltd. is a global renewable energy provider that operates wind farms and solar installations. The company is modernizing its maintenance and operations platform. The company plans to implement a Microsoft Power Platform solution for the operations team. The implementation will include Microsoft Dataverse, a model-driven app, and Power Automate cloud flows.
The company is building and testing a new model-driven app named Operations. The solution will support operations managers, regional coordinators, and field technicians. The app must integrate with an external cloud-based system that manages onboarding of field technicians.
Contoso Ltd. plans to improve data quality and enforce consistent business logic across the app and automation processes.
Technical environment
Contoso Ltd. has an Identity and Access Management (IDAM) department that manages security. The company has one Power Platform environment named Production, where all building and configuration take place. Auditing is disabled.
The Production environment has the following security configurations:
• IDAM has a Microsoft Entra security group named Contoso Ltd. QA. This security group will assign all members a Power Apps license.
• IDAM created a Quality Assurance security role that grants read and write access to all custom tables.
• IDAM also created a team named Testers in Dataverse, of a Microsoft Entra group team type. The team is configured for the Contoso Ltd. QA security group. The Testers team is assigned the Quality Assurance security role.
Microsoft 365 environment:
All Contoso Ltd. managers are included in a Microsoft 365 group named Managers. The group is NOT enabled for email.
The company shares a SharePoint list with a key customer: Alpine Ski House. Alpine Ski House staff members can add new maintenance requests, which are then checked and marked as reviewed by Contoso Ltd.
Current issue:
A new QA tester joins Contoso Ltd. The IDAM department adds the new tester to the Contoso Ltd. QA security group. However, the new tester is not listed in the Testers team as a member.
Other applications:
A separate software-as a-service (SaaS) solution named TechCheck manages technician onboarding. The TechCheck solution is set up as follows:
• TechCheck assigns a unique number named Ref to all technicians.
• Users cannot make changes to the TechCheck data model.
• Users cannot use the same TechCheck ref on more than one Technician row.
Automation requirements
Contoso plans to use Power Automate to develop a Maintenance Request Approval flow. The flow must meet the following requirements:
• Create a Maintenance Request row in Dataverse when either of the following occurs:
o An item is added to the SharePoint list by the customer with the Priority property set to High.
o Any item is checked and marked as reviewed by a Contoso Ltd. representative.
• Seek maintenance request approvals from managers through both email and a Microsoft Teams message after they have been reviewed:
o Requests require approval from all managers.
o If one manager rejects the request, approval must not be granted.
o The result of the approval request must be sent to the initial reviewer in an email. The subject line must set the response as either Approve or Reject.
Contoso Ltd. requires the following table logic:
• If a user tries to enter a price greater than the cost on a new Asset row, the row must display an inline error message.
• If a user tries to save changes to a Technician row where the TechCheck ref column is empty, the action must be prevented and a message explaining the action must be displayed.
o Any updates made to Technician profiles in TechCheck must be mirrored in Dataverse by using a custom integration. The developers building the integration require an index for performant searches on the Technician table.
Data model and app design
Contoso Ltd. plans to use Dataverse as its central data platform. Log storage must be minimized.
Tables
The following tables are required for data modeling and the app design:
• Assets: Stores information about solar panels and wind turbines
• Maintenance Requests: Tracks issues and maintenance activities. The table must include the following columns:
o Request ID (auto-number)
o External Request Code (text)
o Assigned
o Technician (lookup to Technicians)
o Report (lookup to Maintenance Reports)
o Technician updated (Yes/No)
• Maintenance Reports: Tracks the results of maintenance reports
• Technicians: Stores technician assignment data. The table must include the following columns:
• Full Name (Text)
• Mobile phone number (Text)
• Email (Text)
• Seniority (Choice)
• TechCheck ref (Text)
Data modeling
The data model must provide the following functionality:
• Maintenance Requests must:
o be uniquely identifiable across systems.
o have two inactive statuses, Cancelled and Duplicate.
• If a new option is added to an existing set of options, it must be made available automatically for selection on all columns that use the set.
• A new column named Priority must be added to multiple tables. Users must be able to select only one option from the following set per row:
o Low
o Medium
o High
o Critical
Changes to the Technician column on Maintenance Requests must be tracked for compliance purposes. Rows must include the names of previous and current technicians and the time of the change.
Relationship requirements
• One asset can be related to many maintenance requests. A maintenance request can have many assets.
• A maintenance request can have only zero or one maintenance report.
• Only one Technician can be related to a Maintenance Request at a time.
• When a Maintenance Request is deleted, any Maintenance Reports associated with it must also be deleted, but this action should be prevented if there is value in the Technician lookup.
• When a Maintenance Request is assigned to a different owner, the Maintenance Report associated with it must be reassigned to the new owner as well, but the associated Technician should stay with the current owner.
App design
The Technicians table contains the following public views:
• Senior Technicians
• Junior Technicians
The Senior Technician view must be available through the table list view selector to a set of specific users only.
A tester creates a personal view named Hot Assets on the Assets table. The tester recognizes that the view is useful for the entire testing team. The view must be made accessible to the team.
You need to ensure the new QA tester can access the app to perform testing.
What should you do?
Key Takeaways
The trap is assuming license assignment (B) provides data access; the key insight is that Dataverse permissions require explicit security roles, either via team membership or direct assignment.
Learn how to grant Dataverse access to new QA testers in Microsoft Power Platform by assigning appropriate security roles when team synchronization is insufficient.
Common mistake: Choosing B is common because users think a license equals access, but licenses only allow app launch, not data interaction without proper security roles.
Expert Analysis
The core issue is a gap between identity assignment and Dataverse security provisioning. The case study states that the new tester was added to the 'Contoso Ltd. QA' Microsoft Entra security group, which grants them a Power Apps license (Option B). However, access to specific data and tables in Dataverse is controlled by security roles assigned via teams or direct role assignment. The 'Testers' team in Dataverse is configured as a Microsoft Entra group team linked to the 'Contoso Ltd. QA' group. When a user is added to an Entra group that backs a Dataverse team, they are automatically added to that team.
However, the prompt explicitly states: "the new tester is not listed in the Testers team as a member." This indicates a synchronization delay or a specific configuration requirement where the team membership hasn't propagated yet, or more likely, the question tests the immediate administrative action required to grant the necessary permissions while acknowledging the existing setup. Let's re-read carefully. The IDAM department added the tester to the Entra group. The Testers team is configured for that Entra group. Usually, this means automatic membership. If the tester is not listed, it might be due to timing, but the exam often looks for the definitive permission grant.
Let's look at the options again. A is incorrect because environment access isn't the primary blocker if they have a license; they need data access. B is already done (IDAM granted the license). C provides no permissions. D involves assigning the Quality Assurance security role. Since the Testers team is assigned this role, adding the user to the team effectively assigns the role. But the user is not in the team. To ensure they can access the app immediately, manually assigning the security role directly to the user is the most reliable way to bypass any team sync latency or configuration nuance, ensuring they have the read/write access to custom tables defined in the QA role. Alternatively, if the system is working correctly, being in the Entra group should add them to the team. If they aren't in the team, maybe the role needs to be assigned directly? Or perhaps the question implies that simply having the license (B) isn't enough, and we must ensure the security aspect is handled. Wait, if the Testers team is linked to the Entra group, and the user is in the Entra group, they should be in the team. If they are not, it's a technical glitch. But in exam logic, if you need to ensure access, and they lack the role/team membership, assigning the role directly (D) is the corrective action for their lack of permissions. Actually, looking at standard Power Platform administration, if a user is in the backing Entra group, they are a member of the team. If the scenario says they are not, it might be a trick about the order of operations or a specific constraint. However, Option D is the only one that grants the necessary data permissions. Option B is already stated as completed. Therefore, D is the logical step to ensure they have the rights associated with the QA role.
Official Reference
- https://learn.microsoft.com/en-us/power-platform/admin/security-role-database-administrator
- https://learn.microsoft.com/en-us/power-apps/maker/model-driven-apps/create-security-role
- https://learn.microsoft.com/en-us/power-platform/admin/assign-security-role
These links open the official vendor documentation in a new tab.
Exam Strategy
When troubleshooting access issues in Power Platform, always separate licensing from permissions. A Power Apps license allows launching apps, but Dataverse security roles determine what data a user can see or edit. If a user is in an Entra group but lacks expected access, check if their team membership has synced; if not, or if immediate access is needed, assign the relevant security role directly.
Frequently Asked Questions
Does a Power Apps license give access to Dataverse tables?
Why wasn't the tester automatically added to the Testers team?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
exam_upskill 👍 1 Answered DD. Assign the new tester the Quality Assurance security role.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.