Solved: Users records being assigned to Parent Business Un... - Page 2

MrsRDj14 · ‎08-01-2022

Hello Community,

I have a Dataverse security model set up like this:

Parent Business Unit, and Child Business Units for each Division

Users are assigned to AAD Group of their Division, and an equivalent Dataverse Team is created within the Child BU, Security Role is applied to Child BU.

The security role is a copy of the Basic User role, with the custom tables permissions (Create, Read, Write etc.) set to Business Unit.

The security in terms of RLS works as expected, however when Users submit records, their OwningBusinessUnit is recorded as the Parent Business Unit, rather than the Child Business Unit.

Please advise of what step I may have missed here.

Many thanks in advance for your help.

MrsRDj14 · ‎08-03-2022

As far as I can see Users were not already assigned a Security Role, in fact Users were not added to the Tenant until after the app was created.

Users are being assigned to the correct Security Role, rather it is the incorrect Business Unit they are being assigned to, ie they are being assigned to the Parent BU instead of the Child BU.

MrsRDj14 · ‎08-03-2022

Hi both @SBax and @Fubar , thanks for your support with this. I raised a ticket with MS regarding this and have been informed that there is currently no way to assign Users automatically to the Child BU.

There is an Idea already open for it here if you wanted to vote on it.

Link business units to AAD security groups - Power Platform Community (microsoft.com)

For now, I will try to setup the automation you suggested @SBax .

Thanks again both for the advice, all the best.

SBax · ‎08-03-2022

Hi @MrsRDj14

As our friends at Microsoft have advised, there is no way to automatically assign to a child business unit.

I have achieved this in the past using a flow, and would be happy to support you in doing this if you like?

MrsRDj14 · ‎08-04-2022

Thank you @SBax , it would be great if you can share the flow please, I am hoping to build on trigger of "When a row is added, modified or deleted" to the Users table

SBax · ‎08-04-2022

No problem, leave it with me

SBax · ‎08-04-2022

I have discussed this with the original poster outside of this forum, here is my overall solution for anyone following this post.

We decided to extend the concept, and handle everything in one go (adding the user to the AAD group and update the BU)

A canvas app with two galleries

Gallery 1 is office365 users, with a search box above to search for a user
Gallery 2 is Teams filtered to Azure AD teams

A button that is used to add a user to a team. This button triggers a flow which does the following

takes the user, adds them to the group in AAD
finds the relevant team in Dataverse from the AAD object ID
finds the user in Dataverse from the AAD object ID
Updates the users BU to the BU of the team

@MrsRDj14 - I will DM you in the morning and share my PoC in a solution so you can adapt as required, and create a nice UI for your App

MrsRDj14 · ‎09-05-2022

Hi @SBax thank you for supporting me with this solution.

I have been working on your flow to integrate with our app, but am having trouble getting the final step of the flow to work.

I am triggering the flow based a new row being added to the User table, and pulling the domain name from the Teams table to check the User group and Dataverse Team are the same, then trying to reassign the BU.

Can you see where I am going wrong?

Error being: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<title>404 - File or directory not found.</title>
<style type="text/css">

</style>
</head>
<body>
<div id="header"><h1>Server Error</h1></div>
<div id="content">
<div class="content-container"><fieldset>
<h2>404 - File or directory not found.</h2>
<h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>
</fieldset></div>
</div>
</body>
</html>

Please advise if you can see the error here.

Many thanks

SBax · ‎09-05-2022

Hi @MrsRDj14

Which step generates this error?

MrsRDj14 · ‎09-06-2022

Hi @SBax after playing around with it yesterday I think this expression is preventing the flow, I'm now getting this error.

outputs('List_Teams')?['body/value']?['_businessunitid_value']

Unable to process template language expressions in action 'Update_a_row_2' inputs at line '0' and column '0': 'The template language expression 'outputs('List_Teams')?['body/value']?['_businessunitid_value']' cannot be evaluated because property '_businessunitid_value' cannot be selected. Array elements can only be selected using an integer index. Please see https://aka.ms/logicexpressions for usage details.'.

Many thanks for your support

SBax · ‎09-06-2022

Hi @MrsRDj14

Basically what this is saying is the result of the list rows is an array, if you wrap your expression in a first() that will select the first result, and should give you what you need

Users records being assigned to Parent Business Unit instead of Child Business Unit, as per security model

Helpful resources

Community will be READ ONLY July 16th, 5p PDT -July 22nd

Summer of Solutions | Week 4 Results | Winners will be posted on July 24th

Check Out | 2024 Release Wave 2 Plans for Microsoft Dynamics 365 and Microsoft Power Platform

Updates to Transitions in the Power Platform Communities