Environments with CDS - how to tell who has access?

[DS2]

Hi All,

When we created our environments, it was with the old admin center. We have one environment with CDS. I gave access to my admin account and one other admin account and no other users. This interface has now switched to the dynamics interface. I can't seem to tell who has access now. 

Within the Power Platform Admin Center > Environments > My CDS environment > click "..." and go to Settings > Users + permissions > users > Manage users in Dynamics 365 (I don't have Dynamics) > 

Under "Enabled Users" I see almost the whole company. Under "Disabled Users" I see 10 random names. 

Yet, I've got 2 regular user accounts (one is my user account for non-Admin, one is a test) and even though these users are showing up under Enabled Users, they can't see the CDS environment (which is good!)

I am confused as to who actually has access to the CDS environment, considering when created, it was not public and only 2 accounts were set on it. Why do all those enabled users show? How can I actually tell who DOES have access to that environment? It should still be just those 2 admin accounts I originally added under the old interface, plus one other I'd like to add.; 

Thank you for any help you can give me!

[Pstork1]

If you only have one environment then that would be the default environment.  Everyone with a Power Apps license always has access to that environment and that can't be changed.

[DS2]

Hi thanks,

The environment in question with CDS is not the default environment.

[DS2]

Hi, just to clarify, no issues with the default environment, we have several other environments. One of those other environments has a CDS database. This is the one that I'm having the issue figuring out who has access to.

[Pstork1]

If you are an Admin you should be able to query a list of active users and their roles through the Power Platform Admin center.  That's the only way i know of.

[DS2]

I am in the new Power Platform Center, and I see enabled users and disabled users as above. However, I think that the enabled users are for Dynamics overall, not that specific environment - as they do not have access to the CDS environment in question - but not sure. With the old admin center, was very easy to see who had rights and having trouble figuring it out with the new Power Platform Center with its Dynamics settings.

[grantreid]

I'm going to jump in on this one as I have a similar issue.  When creating an environment, I didn't have a security group ready, so skipped that and carried on. In hindsight...  from: 

https://docs.microsoft.com/en-us/power-platform/admin/control-user-access

• If a Common Data Service environment does not have an associated security group, all users with a Common Data Service license (model-driven apps in Dynamics 365, such as Dynamics 365 Sales and Customer Service, Power Automate, Power Apps, etc.) will be created as users and enabled in the environment.

So I think this explains why you have so many enabled users. I appear to have the same thing. 2640 users, which are probably all those with E3 PowerApps licenses enabled. If I open one of them, they appear to have read/write permissions.

The next line in that doco says: 

• If a security group is associated with an environment, only users with Common Data Service licenses that are members of the environment security group will be created as users in the Common Data Service environment.
  

Can someone confirm: By creating a security group, adding the required users  and assigning it to the environment... "everyone" will get removed? 

[Pstork1]

I can confirm that if you create a security group for an environment only the users who are in that group will be able to use things from that environment.

[spfxuser]

When a cds is added to an environment users management is done in dynamics 365.

There are system roles and enabled users. You may check each user is assigned to which role by clicking on the user.

System roles will also have the environment maker role but not environment admin.

Dont create a database if you are not using cds or not familiar with dynamics365 its a headache.

[Gowmadrid82]

I found this post as I had a similar issue. I created an environment a year ago and was asked the question who had access and I could not find any obvious way to see this. All I could see was all users listed in the environment and could only check the roles user by user. Although, my use case was that I wanted to find anyone in that user list that had the 'Environment Maker' role. If anyone runs into this problem, this is the solution:

1. Open up the Power Platform admin centre
2. Select Environments
3. Select the environment you want to check user access on
4. Select the Environment URL (under the details section) near the top of the page
5. Select 'settings top right and then 'advanced settings'
6. Select the down arrow next to settings (top of page) and select 'Security'
7. Select Users
8. Select Advanced Find (it is the filter funnel top right hand side)
9. Select New
10. Select Users in the 'Look for' section, then click on the select below it and select security roles
11. Click select again below security roles and then select 'security role' and enter the value you want to check. In my case it was the Environment Maker role
12. Click 'Results'