Users records being assigned to Parent Business Unit instead of Child Business Unit, as per security model

[MrsRDj14]

Hello Community,

I have a Dataverse security model set up like this:

Parent Business Unit, and Child Business Units for each Division

Users are assigned to AAD Group of their Division, and an equivalent Dataverse Team is created within the Child BU, Security Role is applied to Child BU.

The security role is a copy of the Basic User role, with the custom tables permissions (Create, Read, Write etc.) set to Business Unit.

The security in terms of RLS works as expected, however when Users submit records, their OwningBusinessUnit is recorded as the Parent Business Unit, rather than the Child Business Unit.

Please advise of what step I may have missed here.

Many thanks in advance for your help.

[SBax]

Hi @MrsRDj14 

I suspect that users are being added to the parent business unit when they are added to the environment, and being added to teams separately.

Can I ask, are user always in one Azure AD group, or can they be in multiple?

If it's just one, you could possibly write a flow to change the users business unit to the business unit of the team when they are added.

I am happy to support with writing that flow if this solution sounds suitable for you

[MrsRDj14]

Hi @SBax thank you for your response.

How can I prevent Users being added to the parent business unit? When sharing the app I can only see the AAD Group name, and not the Team name in the list so I wondered if this is happening at this point.

Users are only assigned to one AAD Group.

If I were to manage this via a Flow would each user need Power Automate license? I do not want to assign Power Automate licenses to users.

Many thanks for your support.

[SBax]

Hi again,

thats good news that they will only be in one team

Only the flow owner will require a Power Automate Licence

to put this together, please follow the steps in this blog to set up your trigger

Once you have your trigger set up, you would use action steps like the below:

in the business unit box on the second action it's <Business Unit (Type)>s(<business Unit (Value)>)

hope this helps

[MrsRDj14]

Thanks for the link @SBax 

I'm wondering how I can prevent Users being assigned to Parent BU in the first place?

Unless there is a way to stop this I will try to setup this suggested flow.

[SBax]

I'm following you now, so you don't want to switch them from the default BU to the correct BU, you want to add them to the correct BU when they are added to the app?

Are you adding your users via power platform admin center or are they added to the app as a result of being a member of an AD group? 

[Fubar]

You may be able to do it by creating a Team of type AAD Team and set its Business Unit to the Child Business Unit.  (this is not the same as a Security Group added to the Instance).  Otherwise, you will need to either move the Users to the Child Business Unit or implement Flow/Workflow to move to or assign the desired Team as the owner of the records on Create etc

[MrsRDj14]

I have shared the app with the AAD Group, which is represented by the Dataverse Team within the security structure I have created. 
Is it possible to share an app directly with a Dataverse Team, or another way of preventing the Parent BU assignment?

[MrsRDj14]

Hi @Fubar  thank you for your response. I do have an AAD Security Group team in the Dataverse, which represents the AAD Group, which is owned by the Child BU. 

This is why I am surprised at the behaviour. Based on my structure I would expect Users to be automatically assigned to the Child BU rather than the Parent.

[Fubar]

You may need to make sure that your users were not already populated in DataVerse e.g. part of the Security Group attached to the Instance or if no Security Group on the instance at all (default used to be all AAD users with a licence would populate if no Security Group specified against the Instance)