A company uses Dynamics 365 Customer Sen/ice. A customer service supervisor must create canvas apps. The environment uses a Microsoft Dataverse…

The Environment Maker role is specifically designed for users who need to create resources such as canvas apps, connections, and Power Automate flows within an environment. Crucially, this role does not grant any privileges to access or view the data stored within the Microsoft Dataverse database. This perfectly aligns with the scenario's requirements to provide creation capabilities while strictly prohibiting data access, thereby adhering to the principle of least privilege.

B. System Customizer: This role has read-only access to most application data to see customizations in context, which violates the "no data access" requirement.
C. System Administrator: This role has full permissions over the entire environment, including unrestricted access to all data, which violates both the "no data access" and "least privilege" principles.
D. Environment Admin: This role grants full administrative control over an environment, including managing users and data, which far exceeds the required permissions and violates the stated constraints.

1. Microsoft Learn. (2023). Predefined security roles. In Power Platform documentation. Retrieved from https://learn.microsoft.com/en-us/power-platform/admin/database-security#predefined-security-roles.

Section: Predefined security roles. The table in this section explicitly states for the Environment Maker role: "However

this role doesn't have any privileges to access data within an environment." For the System Customizer role

it notes: "users with this role can only view records for environment entities that they create." For the System Administrator

it states: "Can view all data in the environment."

2. Microsoft Learn. (2023). Configure user security in an environment. In Power Platform documentation. Retrieved from https://learn.microsoft.com/en-us/power-platform/admin/database-security.

Section: Environment Maker. This section details that the role is for building assets and explicitly contrasts it with roles that have data access

reinforcing its suitability for this scenario based on the principle of least privilege.