Answered

Force Sync Dataverse Group Team Members from Azure AD Security Group

(1) Share

Report

Posted on by carl1to

208

I have Dataverse solution in an Environment with different Group Teams that are assigned with appropriate role (for example HR, Department Leaders, CFO....). These groups should get populated from Azure AD Securtiy Group. (as explained here: https://thehosk.medium.com/dynamics-365-and-ad-groups-ac87856a4c54

Now the members in the group team are only created at the time the respective user accesses the solution/dataverse. (tested with some accounts).
Also the "Force Sync User" Activity from Power Platform Admin Connector does not populate the user in the correct group.

(https://nishantrana.me/2021/12/13/using-force-sync-user-to-sync-powerapp-crm-users-power-platform-dynamics-365/amp/ )

Is there a way to force populate the groups?

Otherwise I have to ask each and everyone to access the dataverse/md-app....

The Environment is secured with a Security Group from a AD-Group containing all the other AD-Groups.

Categories:

Microsoft Dataverse with Power Apps

I have the same question (0)

All responses (13)

Answers (1)

Sort by

Drew Poggemann 9,287 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

Hi @carl1to ,

Please see the following: https://docs.microsoft.com/en-us/power-platform/admin/control-user-access that discusses nested security groups and the ability to setup an Azure AD Group Team to accomplish what you are trying to do.

Was this reply helpful? Yes No

carl1to

208 on at

Like (0)

Report

Copy link

Link copied!

Hi @dpoggemann

Thank you for your reply.

I already created a Group Team (type AAD Security Group) for each of my AD Groups inside this environment, but the problem is, that they all stay empty (even after a day). I didn't find the information on your referenced page how to populate the members in the Group Teams other than just asking the members to access the environment (by clicking on the env-name.crmX.dynamics.com).

AD-Group	Members (in AD)	Description	Group Team	Members (of Group Team)
HR-Grp	Max, Ann	Members of HR	HR-Team	Max
Board-Grp	Phil, Pete	Members of Board	Board-Team	-
EnvSecurity-Grp	HR-Grp, Board-Grp	Security Group of Environment	-

Max was added to the environment group team HR-Team because he accessed the environment.

Is there a way to add Ann, Phil and Pete to their teams without asking them to access the envrionment?

I use the Group-Team members inside my application: for example the user can chose an Approver inside a process from the members of the "Board-Team". When the members are not automatically in sync with the users in the AD-Group "Board Grp", then this will lead to problems as soon as there are personel mutations.

Was this reply helpful? Yes No

Drew Poggemann 9,287 Most Valuable Professional on at

Like (1)

Report
Copy link

Link copied!

If that doesn't work then the only way I know to force all users down (currently) is to have a security group that is something like "All Users" and add users to this manually vs nested groups and set this as the security group attached to the environment. Sorry.

Was this reply helpful? Yes No
Verified answer

ValeriaT 19 on at

Like (3)

Report
Copy link

Link copied!

After using Force Sync action add an Invoke HTTP request with Azure AD action. But there is a trick, you should impersonate a user that you force synced (use this manual to do so https://github.com/MicrosoftDocs/powerapps-docs/blob/main/powerapps-docs/developer/data-platform/webapi/impersonate-another-user-web-api.md).
So after you do force sync search for the user GUID in dataverse and add it to request's header MSCRMCallerID.
Good news, that even an unsuccessful request gets you groups) I used both GET and POST requests

Was this reply helpful? Yes No
m3ngi3 725 on at

Like (6)

Report
Copy link

Link copied!

I noticed that using the app access checker in the User Settings of a Power Platform Environment also seems to force
- the sync of the User
- as well as any (AAD Security Group) Team the user is a member of:
Very useful for Power Platform Admins to force this easily 👍

Was this reply helpful? Yes No
Cam 185 on at

Like (0)

Report
Copy link

Link copied!

@Djangois your screenshot of a Dataverse for Teams environment or a Dataverse environment?

my D4T User screen looks different to yours.
when i select the 'app access checker', the page fails to load.

Was this reply helpful? Yes No
Cam 185 on at

Like (1)

Report
Copy link

Link copied!

hello @ValeriaT ,

do you have more information about how you did the 'HTTP with Azure AD' action?

also, what base resource URL / Azure AD resource did you use to connect to the Dataverse for Teams environment?
i tried the below but it didnt work.

thank you

Was this reply helpful? Yes No
ValeriaT 19 on at

Like (1)

Report
Copy link

Link copied!

I used a simple HTTP action but with Bearer token auth and MSCRMCallerID set to guid of the existing user (I pushed it with Force Sync connector). Please see enclosed screenshots
First is for Force Sync. Use graph.microsoft.com link in Azure AD connection.

And for impersonation use simple HTTP connector, not Azure AD. And request is just simple asking for a system users list, you can do whatever you want.

Note, that impersonation may fail, but it still will get you teams. I terminate the flow with success, but also you can try assigning the role with particular privileges to a user you're trying to impersonate BEFORE you will call a request to impersonate.

Was this reply helpful? Yes No
Cam 185 on at

Like (0)

Report
Copy link

Link copied!

hello @ValeriaT ,

does your solution work for a Dataverse for Teams environemnt, or only for a Dataverse environment?

how do you get the Bearer token for the Dataverse for Teams environment?

thank you

Was this reply helpful? Yes No
ValeriaT 19 on at

Like (0)

Report
Copy link

Link copied!

This solution was made for Dataverse.

I used something like this to get a token and an App Registration in Azure, which was added as a user to Dataverse. This might work for Teams as well
https://softchief.com/2022/04/12/connect-dataverse-dynamics-365-using-bearer-token-using-power-automate/

Was this reply helpful? Yes No