Users, Roles, Groups, Teams, Business Units???

[IPC_ahaas]

I am so confused. What seemed like a simple task to define what users should have access to what Environments (and the apps within it) has bloated into an ocean of user created videos hosted by Microsoft with old and new interfaces spread across dozens of very long learn articles with terrible examples such as "User A" and "Business Unit B". I understand less now than when I started.

In our organization, only one person makes apps - me. I created Dev, Test, and Prod Environments after learning the "Default" environment is really a "Personal" Environment. I'm building a single app to test out this new development flow process (haven't figured out "pipelines" yet).

* My IT team needs access to "Dev" because because.

* Supervisors, whose employees will be using the app, need to kick the tires on apps I development in "Test"

* When it's all good, the app will get pushed to "Prod" where Supervisor's employee's can run the apps.

I assumed Security Groups was the way to do this and ended up buried in "Teams" (but not those "Teams". GOOD GRIEF MICROSOFT! So good at making up words, but here you are using "Teams" way too much) and "Business Units".

Just... what!? I have to make a "Team" that contains a "Security Group" just because you wanted to reuse the word "Team" again? Why the heck can't I just add a Security Group directly to an Environment?

[thecompusmith]

I believe what you're looking for (if I understand your question) is a way to control access to your environments using an AAD security group.  If you edit your environment you can assign a security group to each one and only users in that group can access it.  Security roles, Teams & Business units would be used to control what users have access to once in the environment.

I hope this helps and please let me know if I misunderstood your question.

[Fubar · Accepted solution]

Business Units and Teams existed in the product before AD Security Groups etc were incorporated.

The Security Model can get very complicated quickly.

You can restrict users access to environments by assigning an Office 365 Security Group to the environment (as per the post from thecompusmith) e.g. to allow different sets of users to be users in Prod vs Test vs Dev

Within the Environment you can use Teams and Business Units (in combination with Security Role privillges) to achieve Separation and Segmentation of Data

Users and Teams can also be owners of records (for Tables that have been defined as User/Team), and again this forms part of Separation and Segmentation of Data

More recently there has been the ability to create a Team that is tied to Security Group and Office group.

(and there are additional concepts such as Position and Hierarchy that can be enabled )

[ivan_apps]

Agree with this - Teams in Dataverse is a standalone security concept. There is the ability to synchronize an AAD Security Group with a Dataverse Team, if you create the team via the PPAC, select the Entra ID security group option. Office Groups are also available (which MS Teams automatically creates), so you can even tie in a MS Teams ‘Team’ to a specific access in Dataverse.

[IPC_ahaas]

In this case we don't want anyone to own the data. It belongs to the environment and they'll only be able to interact with it via an app(s). So it sounds like I can ignore Teams and Business Units.

[Fubar]

---

@IPC_ahaas wrote:

In this case we don't want anyone to own the data. It belongs to the environment and they'll only be able to interact with it via an app(s). So it sounds like I can ignore Teams and Business Units.

---

By default there is always the root Business Unit, and its default Team, and adding a User they will be in that default team.

Even where you are not interested in Separation and Segmentation of data, where record ownership helps is allowing you to assign records to users (or Teams) to allow your user to see a list of items that are assigned to them (or their team) to work on (e.g. you will notice a number of out of the box Dataverse Table views that start with "My....." these views have filters preset to filter records assigned to the current user)