Environment access through AAD Security (or Office) Group Team

[xmihux]

Hi,

I have been testing providing access to a Power Platform environment (with CDS) by adding users to a certain AAD group. The Group is linked to an AAD Office Group Team created on Dynamics 365 level. Documentation on this can be found here: https://docs.microsoft.com/en-us/power-platform/admin/manage-teams#about-group-teams

In theory it works fine and after a user logs into the environment, I can see he is added to the team. The team has been assigned 'Environment Maker' role. 

The problem is that if I go to either Power Apps or Power Automate portal, I can't see the environment I got access to. I can access it by a direct link with environement ID and e.g. create a Flow, so access works, but it's not possible to switch to that environment from the default one through the UI. It's just not visible. I waited over 24 hours.

If I assign Environment Maker role to a user directly, then the environment shows up. 

I don't think it should work like this and I would assume it's a bug, but maybe someone experienced a similar issue and found a solution for this?

[jlindstrom · Accepted solution]

so here is a small detail in the instructions--users are not added as an active user until the user logs in to a model-driven app for the first time. Just logging in to a canvas app doesn't seem to do it

nothing "syncs" in this scenario, so it doesn't matter how long you wait. it simply adds the user to the team when they first log in to a model-driven app.

also make sure the role associated with the aad team is set to function like delegated security. on the security role first tab there is a drop-down. change that to basic security.

Also, the seeing the environment may be a different issue--we've seen multiple people report (outside of the team security) that they have issues seeing environments that they have been given access to. Sometimes things get cached on the Power Apps side. the solution for me is to have someone in the environment share an app with me, and then after I access the app, I can see the environment from the environment selector.

another thing that worked in on situation was going to home.dynamics.com and clicking the refresh button at the top of the screen.

If all of this doesn't work, create a support ticket.

@xmihux if this answers your question, please mark it a solution.

[xmihux]

Thanks a lot for all your suggestions.

Showing up as an active user is not an issue here - that works fine once the user opens environment URL. 

I tried everything you mentioned, including changing the value in the drop down of the security role, sharing a model driven app, but nothing makes the environment appear in the top right menu selection in either of the portals (Power Apps / Power Automate) unless the role is given to the user directly. 

I could try another approach...Would you know if there is any easy way to assign a D365 security role directly to a user with Power Automate? Any REST APIs? 

[jlindstrom]

so just having app access doesn’t give you access to the maker portals in those environments. What role did you give the team and what permissions does it have for making apps and flows?

[xmihux]

The team has 'Environment Maker' role. The user who is a member of the team can create apps and flows in the environment. It just doesn't show up.

[jlindstrom]

Share an app with them as co owner. Just a simple canvas app should do. Have them go to the app from the link in the email. That’s what did it for me

[MarkPP · Accepted solution]

I have had similar issues and worked with Microsoft around it. However, currently when using AAD Groups (Unified or Security) and you assign the Environment Maker role to the Team it wont show in the environment selector. As per the article you linked to there is a note

System Administrator and Environment Maker security roles. These are special administrator's security roles and they need to be assigned to the user directly. If these security roles are assigned to Group teams, team members get the team privileges only and won't have any direct/inherited privileges. Team members won't be able to perform all the system administrator and environment maker functions. In addition they won't be able to see the list of all the environments in their tenant.

Hope this helps.

[xmihux]

@jlindstrom Sharing a model driven app finally worked for Power Apps portal, but the environment is still not visible from Power Automate portal, even if I share a Flow. Well, I think the topic is quite exhausted now with the additional input from @MarkPP . Not sure why I omitted this info in the documentation 😉 Thank you Both!