[CoE Starter Kit - BUG]App forbidden error while using COE Admin Command Center app

[Divya473]

Does this bug already exist in our backlog?

• I have checked and confirm this is a new bug.

Describe the issue

Getting the App forbidden error in the COE Admin Command Center app while opening the Flows section.
Attached the screenshot for reference.

We had a check on the connectors part that was mentioned in this request - #10786

Microsoft Dataverse and Power Automate Management connectors are in the same DLP Policy. Could you please confirm what do you mean by Logic flow connector?

Expected Behavior

No response

What solution are you experiencing the issue with?

Core

What solution version are you using?

4.50.8

What app or flow are you having the issue with?

COE Admin Command Center app

What method are you using to get inventory and telemetry?

None

Steps To Reproduce

Open the COE Admin Command Center app.
Open the flows.
Error: App Forbidden

Anything else?

No response

[Divya473]

Hi, only Sync flow errors and Customized emails are loading the data. Rest other sections gives the same App forbidden error.

[mohamrizwa]

Hi @Divya473,
Thank you for raising this issue.

Resolution

Option 1: Configure DLP Policy to Allow Dataverse Domains (Recommended)

The recommended solution is to configure your DLP policy to allow the necessary Dataverse domains:

1. Navigate to Power Platform Admin Center

   • Go to https://admin.powerplatform.microsoft.com
   • Sign in with an account that has Power Platform Administrator or Global Administrator role

2. Open Data Policies

   • In the left navigation, select Policies → Data policies
   • Find and select the DLP policy that applies to your CoE environment

3. Review Connector Configuration

   • Ensure the following connectors are in the Business data group (or the same group):
     • Microsoft Dataverse
     • HTTP with Azure AD
     • Office 365 Outlook (if using email features)
     • Power Automate Management

4. Configure Content Security Policy Settings

   If your tenant has advanced DLP settings enabled, you may need to allow the Dataverse domain:

   • In the DLP policy settings, look for Connector endpoint filtering or Content security policy settings
   • Add the following domains to the allowlist:
     • *.dynamics.com
     • *.crm.dynamics.com
     • *.crm[X].dynamics.com (where X is your region number, e.g., crm11.dynamics.com)
     • *.powerapps.com

   Note: The exact location of these settings may vary depending on your tenant configuration and whether you have preview features enabled.

5. Save and Wait for Propagation

   • Save the DLP policy changes
   • Wait 5-10 minutes for the policy to propagate across the environment
   • Clear your browser cache
   • Try accessing the CoE Admin Command Center again

Option 2: Exempt the CoE Environment from DLP Policy

If the CoE environment is used exclusively for administrative purposes and doesn't contain business data:

1. Navigate to Power Platform Admin Center

   • Go to https://admin.powerplatform.microsoft.com
   • Select Policies → Data policies

2. Edit the DLP Policy Scope

   • Open the DLP policy that's causing the issue
   • Go to the Scope section
   • Under Environment scope, change from "All environments" to "Add environments" or "Exclude environments"
   • Exclude your CoE environment from this policy

3. Apply a Less Restrictive DLP Policy (Optional)

   • Create a separate DLP policy specifically for the CoE environment with the necessary connectors allowed
   • Ensure connectors like Dataverse, HTTP with Azure AD, and Office 365 Outlook are in the same data group

[Divya473]

Hi @mohamrizwa, Thanks for the update, we will check and come back. Please don't close the issue.

[Divya473]

Hi @mohamrizwa, we validated the Option 1 steps and our tenant doesn't have advanced DLP settings enabled to check 4th and 5th steps. So, everything seems fine. We can't exclude the CoE environment from the actual policies.

We can have DLP with minimum settings that do not expose the environment to any security risk, please provide the further guidance to fix this.

[mohamrizwa]

Hi @Divya473,
I have completed the analysis in our environment and was unable to reproduce the reported issue.

Given this, I recommend proceeding with a fresh installation to help resolve the problem. Please let me know if you need any assistance with the process.

[anukamanu]

Hi @mohamrizwa,

I am Divya's colleague,
I do see Endpoint configuration under other connectors but not Dataverse connector.

We recently upgraded the toolkit to latest version, I am not sure what you mean by fresh install?? I dont think its a viable solution as well.

Any other option

[Divya473]

Hi @mohamrizwa,

We excluded the CoE environment from the DLP policy and tested the app again, but we are still encountering the same “App Forbidden” error.

We also verified this behavior in previous versions of the CoE toolkit and are seeing the same issue there as well.

Could you please advise if there are any additional checkpoints or configurations we should review?