You need to run the App access-checker.

The App access checker requires the individual user as its input, so the new QA tester’s email address is the appropriate value. The checker evaluates why that user can or cannot open a model-driven app by examining app sharing, assigned security roles, licenses, and relevant environment access. A Microsoft Entra security-group name or a Dataverse group-team name is not the subject of the diagnostic; those objects can influence access, but the tool performs its analysis for a specific user identity. The manager’s username is unrelated to the tester’s failure. In this case, group-team membership may be synchronized or evaluated indirectly, and the checker can reveal the effective access result even when the user is not visibly listed as a conventional team member. Administrators should also verify that the environment security group, license assignment, app sharing, and table privileges are aligned. Its content maps to the Study Guide objective “configure access to model-driven apps,” including use of the App access checker for targeted diagnosis.

Study Guide reference/topic: “Create model-driven apps — Configure access to model-driven apps.” AB-410 Study Guide | Microsoft Learn technical reference