The short version: Give a contractor Environment Maker in your development environment, plus System Customizer if it has a Dataverse database. Keep System Administrator, Power Platform administrator and Global Administrator with two named people in your own firm. The roles cost nothing; the seat behind a Dataverse app is NZ$32.40 a user a month.
The roles, in one table
Power Platform has roles at two levels, and mixing them up is how contractors end up with more access than the job needs. Environment and Dataverse roles apply to one environment. Tenant roles apply to all of them and are assigned in the Microsoft 365 admin centre.
| Role | Level | What it lets them do | What it does not |
|---|---|---|---|
| Environment Maker | One environment | Create apps, flows, connections and custom APIs, and share the apps they build | Access the environment's data. It has no privileges on data |
| System Customizer | One environment with Dataverse | Create and update tables, and work with solutions, desktop flows and AI Builder | Create or update security roles |
| System Administrator | One environment with Dataverse | Full admin in that environment, including assigning security roles and using the data gateway | Reach other environments |
| Environment Admin | One environment with no Dataverse database | Every admin action in that environment, including adding makers and creating data loss prevention policies | Apply in an environment that has a database: use System Administrator there |
| Power Platform administrator | Whole tenant | Manage all environments, capacity and policies, even without being in an environment's security group | Create users, manage licences, or read Dataverse data by default. Microsoft says a separate System Administrator assignment is needed for the data |
Source: Microsoft Learn, Role-based security roles for Dataverse, Use service admin roles to manage your tenant and Control user access to environments with security groups and licenses, read on 30 September 2026. The Dynamics 365 administrator and Global Administrator roles sit at the tenant level too and are stronger still.
What to give a contractor, by job
| The job | Give them | Keep with you |
|---|---|---|
| Build flows and apps on SharePoint, Outlook and Excel | Environment Maker in the development environment | Production, and every admin role |
| Build on Dataverse | Environment Maker plus System Customizer in the development environment | System Administrator and the tenant roles |
| Deploy to production | Nothing in production. You or a named admin import the solution | Production access. Microsoft's own guidance is that makers and developers should not have access there, or only user-level privileges |
| Set up a service principal or a data policy | A session with your admin present, not a standing role | The Power Platform administrator role |
| Add users or assign licences | Nothing. These are Microsoft 365 admin roles, and the Power Platform admin roles do not include them | User Administrator and License Administrator |
What never to hand over
- Sole admin rights. If the contractor is the only System Administrator or Power Platform administrator, you are locked out the day they leave. Two named people in your firm hold those roles, assigned directly, because Microsoft does not fully support inheriting service admin roles from a security group.
- Global Administrator for a build job. It is a tenant-wide role that covers far more than Power Platform, and the build does not need it.
- A role with no end date. Write the removal date in the engagement notes, and remove the role on that day.
Roles here decide who can build and administer. Who can see which rows once the app is live is a different layer, covered in Dataverse security roles, explained with a real example, and the wider inventory of who owns what is Power Platform governance for a small business. What happens if the contractor is the only person with any of this is in what happens when the person who built your software leaves.
What the roles cost
The roles themselves are free; licences are the price. A person who runs an app that uses Dataverse needs Power Apps Premium at NZ$32.40 a month, and a flow that uses a premium connector needs Power Automate Premium at NZ$24.30 a month, both per user and paid yearly on Microsoft's NZ list. Holding Environment Maker adds nothing to your bill by itself; seats follow what an app uses and who runs it. Ask any contractor whether they will need a licence to test what they build, and who pays for it. The full picture is in the Power Apps premium licence trap.
Common questions
Does the Environment Maker role let someone see my data?
No. Microsoft's documentation says Environment Maker has no privileges to access data in an environment. It lets someone create apps, flows and connections and share the apps they build.
Does a contractor need System Administrator to build on Dataverse?
No. Microsoft says people who make apps that create or update tables need the System Customizer role in addition to Environment Maker. System Administrator is full admin of the environment and should stay with you.
Does the Power Platform administrator role give access to my Dataverse data?
Not by default. Microsoft says tenant roles such as Power Platform administrator manage environments but a separate System Administrator role assignment is needed to access Dataverse data, and these admins must self-elevate before assigning Dataverse roles.
What is the difference between Environment Admin and System Administrator?
Environment Admin applies only to an environment with no Dataverse database. Once an environment has a database, System Administrator is the role that gives full administrative access.
Can a contractor give themselves more access?
Only if they hold a role that allows it. System Administrator and the tenant admin roles can assign security roles; Environment Maker and System Customizer cannot create or update them. That is the reason those admin roles stay with two people in your own firm.
Get the access right before the build
Tell me which environments you have and who holds admin today. Book a free 30-minute call and I will say what a contractor needs and what to remove.