Latency issue between Azure AD and Environments

[AhmedSalih]

Hello,

I have created Azure AD security groups for my Dataverse security model (Field based security using Environment Teams). I then created Environments Teams for those AAD security groups and assigned security roles for those teams. It has been more than 24 hours and I still don't see the Teams members in the Environment?!! 

Thank you

[dpoggemann · Accepted solution]

Hi @AhmedSalih ,

The security group in Azure AD has users directly assigned, not groups right?  Currently only supports static user assignment vs. dynamic groups and sub-groups.

[AhmedSalih · Accepted solution]

@dpoggemann , thank for your reply. When I am creating the Azure AD group, I only have three membership types: Assigned, Dynamic User, Dynamic Device. I f I want to use the Azure AD security group with the environment Teams, what should I do? Is there is another way to create teams? Thank you

[AhmedSalih]

So, we should just create teams and users manually in the environment. Thank you

[dpoggemann · Accepted solution]

Hi @AhmedSalih ,

You can assign to security groups and this is a good approach to allow your admins to add individuals to security groups and have them align to Teams in Dataverse.  You must use the "Assigned" as the other two types are not currently supported.  Dynamic Groups is in the roadmap from what I understand.

https://docs.microsoft.com/en-us/power-platform/admin/manage-group-teams 

Configuration details here:

https://docs.microsoft.com/en-us/power-platform/admin/manage-group-teams#create-a-group-team 

[AhmedSalih]

@dpoggemann , that is exactly what I did but the AAD members won't populate in the aligned Environment Team and I thought it is just a time thing and I am still waiting. 

[ChrisPiasecki · Accepted solution]

Hi @AhmedSalih,

When you create an Azure AD Group Team, users do not show up in the team member list until they access the environment for the first time. Access checks are performed at runtime for the user and if they are part of the AD group, they will be added as a member of the team and show up in the list. 

As per docs:

Team members are dynamically derived (added and removed) when they access the environment based on their Azure AD group membership.

---
Please click Accept as Solution if my post answered your question. This will help others find solutions to similar questions. If you like my post and/or find it helpful, please consider giving it a Thumbs Up.

[AhmedSalih]

@ChrisPiasecki I wish for I can mark both of your answers as solution. I spent the weekend trying to figure out this and I now know why exactly AAD users weren't showing up in the team member list. I just tried to get a user to access the Environment and he was immediately populated. THANK YOU SO MUCH GUYS

[dpoggemann]

Hi @AhmedSalih ,

I marked @ChrisPiasecki's as a solution for you 🙂