AAD sync to systemuser table

(0) Share

Report

Posted on by KiloZidTirol

hi there.

i'm looking for that for quite a long time now, without any real solutions.

my problem:

i have an app for our storage guys, to track equipment they give away.

within this app, i have 2 lookup columns (for and pickedupby) to the systemuser table.

so far, no problem, works fine until the colleagues informed me, that there are users missing (some new ones, some old ones).

i know, i can add them manually via the power platform admin portal, or inform the users to open make.powerapps.com.

but: i don't want (and haven't the time) to add alle the users manually also new employees "get" equipment before they even logged on (keyboard, mouse, screen, cables, and so on).

i also saw, that these users are missing on our 4 environments (dev, test, prod and default) so adding them manually is absolutely no solution.

does anyone know, what is needed, that the new users get synced to the systemuser table automatically?

did microsoft change something regarding the licenses and/or apps?! our users get the E5 license by default, only a few have lower licenses.

i also tried to add these 2 licenses to a missing user:

Microsoft Power Apps Plan 2 Trial
Microsoft Power Automate Free

both are included to the E5 license, as i can see on the apps (Power Apps for Office 365, Power Automate for Office, Power Virtual Agens for Office) are available and selected for them.

thanks in advance.

Categories:

Microsoft Dataverse with Power Apps

I have the same question (0)

All responses (6)

Answers (0)

ChrisPiasecki 6,422 Most Valuable Professional on at

Like (0)

Report
Hi @KiloZidTirol ,

Users get automatically added to the environment depending on the following:

If the environment does not have an AAD security group associated with it, all premium licensed (including trial) are automatically added into the environment.

If the environment does have an AAD security group associated with it, users with a premium license (including trial) AND are direct members of the AAD security are automatically added into the environment. Note that nested security groups won't work so that's why i mention the user has to be a direct member in the AAD group.

Another thing to note is that automatic sync can take some time depending on the size of your AAD and whether a security group is associated with the environment.

More information at the references below:

Control user access to environments: security groups and licenses - Power Platform | Microsoft Docs

Add users to an environment automatically or manually - Power Platform | Microsoft Docs

---
Please click Accept as Solution if my post answered your question. This will help others find solutions to similar questions. If you like my post and/or find it helpful, please consider giving it a Thumbs Up.

Was this reply helpful? Yes No
KiloZidTirol 4 on at

Like (0)

Report

hi @ChrisPiasecki
thanks for the reply.
that's the point, the environment doesn't have a group assigned. as it is the default environment, i'm not able to assign a group to it at all. but still, not all premium licensed users get synced there 😞
i mainly talk about the default env, as the app is there and it is not used for crm. it's mainly used for powerapps and automate.
the users which are missing, have access to the env, that works fine. i tried that with a test-user: go to make.powerapps.com, opens the power apps portal fine, afterwards the test user did show up in the systemuser table, but that can't be the final solution, to tell everyone who can't be selected within the app to open the powerapps site (as it isn't even possible for every new employee, for example, when the employee starts on monday, but get the equipment on friday, he/she can't be selected, even if the account is already created since 2 weeks).

the other 3 envs will get groups assigned, hopefully soon, as we're reworking the security strategie for those (crm) environments.

Was this reply helpful? Yes No
ChrisPiasecki 6,422 Most Valuable Professional on at

Like (0)

Report

Hi @KiloZidTirol,

In the case of the default environment, any user with a Power Apps licensed (including the standard license that comes with Microsoft 365) will be added into the default environment with Environment Maker privileges. This will take the longest environment for users to sync to because of it being widely available to all licensed users and no security group can be assigned. How long have you tried waiting for the user to show up in the environment?

Your other option is to create a Power Automate flow to add users into your environments as part of an onboarding process.

---
Please click Accept as Solution if my post answered your question. This will help others find solutions to similar questions. If you like my post and/or find it helpful, please consider giving it a Thumbs Up.

Was this reply helpful? Yes No
KiloZidTirol 4 on at

Like (0)

Report

hi @ChrisPiasecki
i would change the "will be added" to "should be added" 😊😉😅
the collegue informed me on february 3rd and 11th about 4 missing records (2 on each day) in that table, which are still not there.
one of the missing records has been created on 12th of january 2021
one on 14th of july 2017 (has been reactivated mid-end of january 2021)
2 on 29th of may 2017 (got reported both in february, eventually they have been disabled some time, but not 100% sure)

so even if it takes longer for the default environment to sync all users, i think it shouldn't take MONTHS 🤔

in my opinion, there is a sync in the background anywhere where i can't find it which isn't working correctly or the process is stopped 🤔 or something has been changed, so it doesn't recognize every user account anymore.
if i could just find any information about where or how this sync could be defined or influenced 🤔

i'll think about the flow, that would be good for at least new employees 😊👍 but what's with the actual missing users?!

Was this reply helpful? Yes No
ChrisPiasecki 6,422 Most Valuable Professional on at

Like (0)

Report

Hi @KiloZidTirol,

Does your default environment have a Dataverse database provisioned in it? If it does, can you check the Disabled Users list to see if they show up there? If they were previously added and disabled then they may show up there. You may just simply have to enable the account.

If still no luck, then I'd recommend opening a ticket with Microsoft support to triage the issue, as it shouldn't take days to months to sync.

---
Please click Accept as Solution if my post answered your question. This will help others find solutions to similar questions. If you like my post and/or find it helpful, please consider giving it a Thumbs Up.

Was this reply helpful? Yes No
EricRegnier 8,720 Most Valuable Professional on at

Like (0)

Report

Hi @KiloZidTirol, not sure if this is resolved yet, but if ever a user takes a long time to sync or not in the environment, you can manually add the user. Here are the steps: https://docs.microsoft.com/power-platform/admin/add-users-to-environment#:~:text=To%20add%20users%20to%20an%20environment%20that%20has%20a%20Dataverse%20database

BTW: I would recommend not to use the Default environment for production Power Automate flows or apps. It should be only a play area for your users. For more tips: https://powerusers.microsoft.com/t5/Power-Apps-Community-Blog/Top-15-best-practices-when-configuring-Power-Platform-and/ba-p/850804

Cheers!

Was this reply helpful? Yes No