Exam PL-600 topic 2 question 33 discussion

For the third one, the answer is a security role. Because system customizer does not have read permissions the answer must be Service Reader. https://docs.microsoft.com/en-us/power-apps/maker/canvas-apps/share-app

Answers are correct. For the 3rd box, the users are added to the "environment" security group (which is necessary). They then should/could be added to another security group that is share with the app.

Answers should be "Customizer Role", "Basic Role" and "add users to the superuser team". Explanation: In Power Platform, environment access is controlled by Azure AD security groups, but app access is controlled by security roles and team membership. Even if users are in the Azure AD security group that grants access to the environment, they won’t automatically have access to apps unless they are: Assigned the correct security role, or Added to a team (like the superuser team) that has the necessary permissions. Why the other options are incorrect for canvas app access issue: a. Assign the system customizer role Too broad and powerful for general users; not best practice for app access. b. Assign the service reader role This role is for reading service-related data, not for app access. d. Add users to an Azure AD security group They are already in the group, but that alone doesn’t grant app access.

provided answers are correct : customizer basic AAD

Provided answers are correct: 1. System Customizer 2. Basic User 3. AAD Security Group For the third it says "add users to an azure ad security group". So it could be a separate AAD Group with a related team and inherited security role.

third D: Reason it says "environment Azure AD security group" and it suggest "Azure AD security group" so maybe there are 2 Azure AD security groups? Service reader is so wrong!

i am not sure this is correct - in the text above it say - "Users are added to the environment azure ad security Group and are not able to access the canvas app" So they are already in a Security Group - so they just need a security role for the canvas app.

For number 3, being added to an environment securiy group does NOT mean they can access a canvas app. They need to be either added themselves or added to a security group that is then add. So the answer are correct

The pre-established 'Service Reader' security role can no longer be assigned directly to a user. The 'Service Reader' role is endowed with full read permission for all entities, including custom entities. This role is primarily employed by the service and necessitates read access to all entities. However, it cannot be assigned directly to a user or team. The 'Service Reader' role might have been the correct answer in the past, but under current conditions, it no longer is. Despite these changes, there is still a workaround to assign the 'Service Reader' role to a user or team. This can be achieved by creating a duplicate of the 'Service Reader' role and assigning this custom role to the user or team. Given that the 'Service Reader' role cannot be directly assigned to a user or team anymore, I would choose answer D. For more information, you can visit: https://learn.microsoft.com/en-us/power-platform/admin/database-security#predefined-security-roles

third answer appears to be correct " Specify each user by name, or specify a security group in Azure Active Directory (Azure AD). " https://learn.microsoft.com/en-us/power-apps/maker/canvas-apps/share-app

Agree that 3rd one cannot be "Add users to an Azure AD Security Group" as the question mentions this step is already done. In a real-world scenario, I'd check that 1) the Azure AD Security Group is actually configured for access to the Power Platform environment of the Canvas app, and that 2) users have the appropriate security roles, so I'd say "Assign the Service Reader role" is a more likely answer. The proposed answer would be a 3rd step if both 1) and 2) are done and the issue persists.

Answer is 1, 1, 2

The given answers are correct!

The third one should be C; add the users to the superuser security role.

The third one cannot be correct because these users are already part of the Azure AD group.