Skip to main content

How to grant Zation the Power Platform Reader role

Grant your Zation Platform Connector App Registration the Power Platform Reader role at tenant scope, so the Dynamics 365 module can discover every Dataverse environment automatically instead of requiring the Zation License Reader application user to be added one environment at a time.

Preview feature, no admin center UI yet

Microsoft ships tenant-wide Power Platform roles through a role-based access control (RBAC) API that is still in preview. There is no Power Platform admin center UI for it yet — the only way to assign the role today is the PowerShell script in this guide.

This step is optional. Without it, the Dynamics 365 module still works — you add the Zation License Reader application user to each environment individually, as described in Permissions → Dynamics 365, Copilot, and Power BI. Granting the Power Platform Reader role once at tenant scope replaces that per-environment step.

Before you begin​

  • The Zation Platform Connector App Registration from Onboarding → Step 2, with its Application (client) ID and Object ID at hand (Microsoft Entra ID → Enterprise applications, search for Zation Platform Connector, copy the Object ID from the Overview page).
  • Your own account needs the Power Platform Administrator or Power Platform role-based access control administrator role in Microsoft Entra ID.
  • If either role is assigned through Privileged Identity Management (PIM), activate it before you start — a role that is only eligible, not active, does not appear in the token this script requests.
  • PowerShell 7 (or Windows PowerShell 5.1) with internet access to install a module.

Steps​

  1. In the Azure Portal, open the Zation Platform Connector App Registration → API permissions → + Add a permission → APIs my organization uses, then search for and select Power Platform API.

  2. Choose Delegated permissions and add:

    PermissionUsed for
    Authorization.RoleAssignments.ReadLists existing Power Platform RBAC role assignments.
    Authorization.RoleAssignments.WriteCreates the Power Platform Reader role assignment for this app.

  3. Click Grant admin consent for <Tenant> → Yes.

  4. Open Authentication on the same App Registration → + Add a platform → Mobile and desktop applications → select the built-in redirect URI https://login.microsoftonline.com/common/oauth2/nativeclient → Configure.

    Why a redirect URI is needed here

    The Graph and Azure permissions from onboarding use a client secret (an app acting as itself). This step instead signs in as you, so Microsoft Entra ID can return the token to your PowerShell session — that requires a registered redirect URI.

  5. Run the following script from a PowerShell prompt, with the placeholders filled in:

    $TenantId              = "<your-tenant-id>"
    $ScriptClientId        = "<zation-platform-connector-client-id>"
    $ZationConnectorObjectId = "<zation-platform-connector-object-id>"

    Install-Module -Name MSAL.PS -Scope CurrentUser -Force

    $token = Get-MsalToken -ClientId $ScriptClientId -TenantId $TenantId `
        -Scopes "https://api.powerplatform.com/.default" -Interactive
    $headers = @{
        Authorization  = "Bearer $($token.AccessToken)"
        'Content-Type' = 'application/json'
    }

    $body = @{
        roleDefinitionId  = "c886ad2e-27f7-4874-8381-5849b8d8a090"  # Power Platform Reader
        principalObjectId = $ZationConnectorObjectId
        principalType     = "ApplicationUser"
        scope             = "/tenants/$TenantId"
    } | ConvertTo-Json

    Invoke-RestMethod -Method Post `
        -Uri "https://api.powerplatform.com/authorization/roleAssignments?api-version=2024-10-01" `
        -Headers $headers -Body $body

    A browser window opens for interactive sign-in — use the account with the Power Platform Administrator or Power Platform role-based access control administrator role.

Verify​

The command prints the created role assignment, including a roleAssignmentId. To double-check later, list all assignments and look for the Zation connector's Object ID:

Invoke-RestMethod -Method Get `
    -Uri "https://api.powerplatform.com/authorization/roleAssignments?api-version=2024-10-01" `
    -Headers $headers |
    Select-Object -ExpandProperty value |
    Where-Object { $_.principalObjectId -eq $ZationConnectorObjectId }

Within 24 hours, the Dynamics 365 module in the Platform picks up every Dataverse environment in the tenant without a manually added application user.

Troubleshooting​

SymptomLikely causeFix
403 Forbidden on every callYour Power Platform Administrator / RBAC administrator role is PIM-eligible but not activatedActivate the role in My Access, then close and reopen PowerShell before rerunning the script — a session opened before activation keeps issuing tokens without the role
Get-MsalToken: command not foundThe MSAL.PS module isn't installedRun Install-Module -Name MSAL.PS -Scope CurrentUser -Force, then rerun the script
401 Unauthorized — AuthorizationHeaderInvalid / BearerMissingTokenThe token variable is empty, usually because the previous step failed silentlyConfirm Install-Module succeeded, then rerun from a fresh PowerShell window
Token has no Authorization.RoleAssignments.* in its scp claimAdmin consent from step 3 hasn't been granted, or was granted after this token was issuedRe-run step 3, then request a new token in a fresh PowerShell window

Next steps​