Share
ReportI’m trying to validate whether what we’re seeing is expected behavior or a configuration / platform issue related to Microsoft Entra ID Group Teams and Just‑In‑Time (JIT) provisioning in Dataverse.
Scenario
We are using Microsoft Entra ID security groups as the source of truth for Power Platform access:
- Environment access is restricted via an Environment Security Group
- Microsoft Entra ID Group Teams are created in Dataverse and linked to Entra security groups
- Security roles are assigned to those Entra Group Teams
- Users are licensed and confirmed members of:
- The environment security group
- The Entra security groups backing the Dataverse team
Per documentation, we expect users to be JIT‑provisioned into Dataverse on first access and automatically inherit team membership and security roles.
What We’re Seeing Instead
- Users can authenticate to Power Apps / make.powerapps.com
- Users are not provisioned into Dataverse
- Users do not appear as members of the Entra Group Teams
- Security roles assigned to those teams are not applied
- Users receive authorization errors such as:
The user with object id '<object-id>' does not have access to permission 'CanEdit' in environment '<environment-id>'.Important note:
- Entra Group Teams cannot be manually edited (expected)
- Manually adding users to Dataverse resolves the issue, which suggests this is not a licensing or role definition problem
What We’ve Confirmed
- AD / Cayosoft / Entra sync is healthy
- Entra group membership is correct
- Entra Group Teams exist and accept security role assignment
- Security roles appear correctly in Dataverse
- Waiting for sync windows (30 minutes → several hours) does not resolve it
- Logout/login and browser refreshes do not resolve it
This feels like the Entra → Dataverse identity provisioning step is simply not triggering.
Questions
-
What exactly triggers JIT provisioning for Dataverse users?
- Environment access?
- Opening a model‑driven app?
- Having a base security role
-
Is Entra ID group membership alone sufficient to provision users into Dataverse, or is some form of manual “bootstrap” required?
-
Are there known issues or limitations where Entra Group Teams do not resolve members even though group sync is healthy?
-
Is this behavior by design, or indicative of a misconfiguration / platform issue?
Why This Matters
Without reliable JIT provisioning:
- Entra ID cannot be used as the single source of truth
- Least‑privilege access becomes manual
- Entra Group Teams lose most of their value at enterprise scale
Any clarification, confirmation, or real‑world guidance would be greatly appreciated.
All responses (
Answers (
457
