Microsoft Power Platform · Environment Roles
Environment Maker
Create apps, flows, custom connectors, and other resources in an environment. Standard role for citizen developers.
Scope: Single environment - create resources, cannot administer the environment itself
Permissions
- Apps - Create canvas apps, model-driven apps, and Power Pages sites
- Flows - Create Power Automate cloud flows and desktop flows
- Custom connectors - Create and manage custom connectors
- Connection references - Create and manage connections
- Environment resources - Create and own resources without managing other members
Common use cases
- Citizen developers in a managed environment
- Pro developers building apps without admin responsibility
- Default role for licensed Power Apps users
Best practices
- Use security groups for Maker assignment
- Pair with environment-level DLP to prevent risky connector use
- Enable Managed Environments for additional governance (sharing limits, weekly digest, solution checker)
Security considerations
- Makers can create apps that access data through any allowed connector
- Apps and flows created by Makers are owned by the Maker - reassign before offboarding
- In Dataverse environments, Makers also need a Dataverse security role to access tables
Common questions
When should I assign the Environment Maker role?
Assign Environment Maker when you need to: Citizen developers in a managed environment; Pro developers building apps without admin responsibility; and Default role for licensed Power Apps users. It is part of Microsoft Power Platform and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Environment Maker role do?
The Environment Maker role grants permissions including: Apps - Create canvas apps, model-driven apps, and Power Pages sites; Flows - Create Power Automate cloud flows and desktop flows; Custom connectors - Create and manage custom connectors; Connection references - Create and manage connections; and Environment resources - Create and own resources without managing other members. See the Permissions section above for the full list.
What are the security risks of the Environment Maker role?
Key considerations when assigning Environment Maker: Makers can create apps that access data through any allowed connector; Apps and flows created by Makers are owned by the Maker - reassign before offboarding; and In Dataverse environments, Makers also need a Dataverse security role to access tables. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.