Force Sync Dataverse Group Team Members from Azure AD Security Group

[carl1to]

I have Dataverse solution in an Environment with different Group Teams that are assigned with appropriate role (for example HR, Department Leaders, CFO....). These groups should get populated from Azure AD Securtiy Group. (as explained here: https://thehosk.medium.com/dynamics-365-and-ad-groups-ac87856a4c54 

Now the members in the group team are only created at the time the respective user accesses the solution/dataverse. (tested with some accounts).
Also the "Force Sync User" Activity from Power Platform Admin Connector does not populate the user in the correct group.

(https://nishantrana.me/2021/12/13/using-force-sync-user-to-sync-powerapp-crm-users-power-platform-dy... )

Is there a way to force populate the groups? 

Otherwise I have to ask each and everyone to access the dataverse/md-app....

The Environment is secured with a Security Group from a AD-Group containing all the other AD-Groups.

[dpoggemann]

Hi @carl1to ,

Please see the following:  https://docs.microsoft.com/en-us/power-platform/admin/control-user-access that discusses nested security groups and the ability to setup an Azure AD Group Team to accomplish what you are trying to do.

[carl1to]

Hi @dpoggemann 

Thank you for your reply.

I already created a Group Team (type AAD Security Group) for each of my AD Groups inside this environment, but the problem is, that they all stay empty (even after a day). I didn't find the information on your referenced page how to populate the members in the Group Teams other than just asking the members to access the environment (by clicking on the env-name.crmX.dynamics.com).

AD-Group	Members (in AD)	Description	Group Team	Members (of Group Team)
HR-Grp	Max, Ann	Members of HR	HR-Team	Max
Board-Grp	Phil, Pete	Members of Board	Board-Team	-
EnvSecurity-Grp	HR-Grp, Board-Grp	Security Group of Environment	-

Max was added to the environment group team HR-Team because he accessed the environment.

Is there a way to add Ann, Phil and Pete to their teams without asking them to access the envrionment?

I use the Group-Team members inside my application: for example the user can chose an Approver inside a process from the members of the "Board-Team". When the members are not automatically in sync with the users in the AD-Group "Board Grp", then this will lead to problems as soon as there are personel mutations.

[dpoggemann]

If that doesn't work then the only way I know to force all users down (currently) is to have a security group that is something like "All Users" and add users to this manually vs nested groups and set this as the security group attached to the environment.  Sorry.

[ValeriaT · Accepted solution]

After using Force Sync action add an Invoke HTTP request with Azure AD action. But there is a trick, you should impersonate a user that you force synced (use this manual to do so https://github.com/MicrosoftDocs/powerapps-docs/blob/main/powerapps-docs/developer/data-platform/web...).

So after you do force sync search for the user GUID in dataverse and add it to request's header MSCRMCallerID.

Good news, that even an unsuccessful request gets you groups) I used both GET and POST requests

[Django]

I noticed that using the app access checker in the User Settings of a Power Platform Environment also seems to force
- the sync of the User
- as well as any (AAD Security Group) Team the user is a member of:

Very useful for Power Platform Admins to force this easily 👍

[Cam]

@Djangois your screenshot of a Dataverse for Teams environment or a Dataverse environment?

my D4T User screen looks different to yours.

when i select the 'app access checker', the page fails to load.

[Cam]

hello @ValeriaT ,

do you have more information about how you did the 'HTTP with Azure AD' action?

also, what base resource URL / Azure AD resource did you use to connect to the Dataverse for Teams environment?

i tried the below but it didnt work.

thank you

[ValeriaT]

I used a simple HTTP action but with Bearer token auth and MSCRMCallerID set to guid of the existing user (I pushed it with Force Sync connector). Please see enclosed screenshots

First is for Force Sync. Use graph.microsoft.com link in Azure AD connection.

And for impersonation use simple HTTP connector, not Azure AD. And request is just simple asking for a system users list, you can do whatever you want.

 Note, that impersonation may fail, but it still will get you teams. I terminate the flow with success, but also you can try assigning the role with particular privileges to a user you're trying to impersonate BEFORE you will call a request to impersonate.

[Cam]

hello @ValeriaT ,

does your solution work for a Dataverse for Teams environemnt, or only for a Dataverse environment?

how do you get the Bearer token for the Dataverse for Teams environment?

thank you