As the Environment security group can only be a single group, I think it is relevant to use a nested Entra ID security group as the Environment security group, in order to include multiple Entra ID security groups.
(By nested group I mean a group where the group members themselves are groups, and these child groups can themselves have child groups as members. So it is like a multi-level hierarchy of groups, and the idea is to use only the top group as the Environment security group. The actual users - people - are only direct members of the groups in the lowest level of the hierarchy.)
This way, any user which is not member of any group in this hierarchy ("pyramid") of groups, will not have access to this Dataverse environment. (Or is it Power Platform environment?)
So it's like a first barrier, and more fine-grained control can be added by using security roles.
When I apply this top group as environment security group, I get a warning message saying I am not member of the group and will not have access to the environment. But I am member of a child group in the hierarchy, so I don't know why I get this warning message. Anyway, after I applied the group, I still have access. So the warning message seems like a bug? Or am I missing something?
Can I share apps and security roles directly with users, and with other security groups (groups which are not member of the nested hierarchy)? As long as the users are member of both a group in the nested hierarchy (environment security group) and they are also member of another independent group which I grant access to a security role and an app, will it work?
This seems to be working based on some small testing I did, but I got confused from the warning message and the Microsoft docs describing the use of nested groups.
