You need to assign the minimum environmental security role to the appropriate users.

Box 1: Environment Maker

UserA must be able to create and publish Power Apps apps.

The Environment Maker role can create resources within an environment including apps, connections, custom connectors, gateways, and flows using Power Automate.

Box 2: System Administrator

UserB must be the owner of all the systems and be able to provide permissions and create all new environments.

The System Administrator has full permission to customize the system. Can view all data in the system.

Box 3: System Customizer

UserC must be able to create apps connected to the systems and update the security roles and entities.

The System Customizer has full permission to customize the system. Can only view rows for system tables that they create.

The difference between the System Administrator and System Customizer security roles is that a system administrator has read privileges on most rows in the system and can see everything. Assign the System Customizer role to someone who needs to perform customization tasks but shouldn’t see any data in the system tables.

Box 4: Common Data Service User

To stay consistent with our product rebranding effort, the security role Common Data Service User is being changed to Basic User.

The Basic User security role primarily contains Basic privileges for core entities where the user can write, update, and delete records that they created or owned.