How to Add all Azure AD users into a prod CDS environment

[mjburley]

I have created the dev - test - prod model for Power Apps development in my tenancy.

I have hit a problem in that non licensed users only appear in the default environment and not my other CDS only environments.

Users of the apps will be licenced, but these apps use look ups into the User table (example: issue raised by user abc), but if these users have no relevant licence they appear to the app as they do not appear in Azure AD.

Example, in an app to raise issues, I use the  'Get User profile' action inside Power Automate to get the user from their email address, and then lookup that user in the CDS environment to add them to the record as the user with the issue. Outside of the default environment, only licenced users will return as being in the environment, so I cannot show the User record.

Is there any way to get all Azure AD users into CDS environments like they appear in the default environment?

I could of course give them all licences, wait for them to sync, and then remove the licences (in batches due to licence numbers), and then they will appear as disabled users which is fine, as they will exist. But this is an ongoing maintenance issue with new starters.

Is there a better way? It does make the ALM model tough to achieve inside Power Apps. All users have the E5 licences.

[MrRegalius]

Hi,

I think it might be better to create a new table called "Employee" or "Azure AD User" in your Power Platform environment. This way you can just create records in these tables without any hassle with the licenses.

This way you can keep your Power Platform Users who are actually using you App separate from the Employees in your organization not in using you app. You could always include a lookup column on the System Users table to point to an Employee record, as some users will exist in both of course.

Temporarily assigning licenses to office users seems like a lot of work, even if the syncing of licensed users to Power Platform goes rather quickly.

[mjburley]

Thanks, it still leads to a manual (powershelled?) overhead of adding users into the Employee table, and loses the info that comes with Azure AD. My org has high turnover.

It just seems that this should be part of the Power Platform to me - most business apps I am involved in revolve around the users in the org, and they can run Power Automate Flows without a separate Power Apps licence, so why shouldn't an app be allowed to natively pick the user?

[MrRegalius]

Hi,

PowerShell could be an option to get the information out of Azure AD.
You could also write a Power Automate that gets this information daily or hourly.
All the information inside Active Directory should be accessible through PowerShell so you can save it in Dataverse.

I certainly see your point, but the systemusers table have always been licensed users that actually use the application. This has been this way for years, but you could always create an Idea, but I don't see this getting any traction.

While writing this I was wondering if the office 365 connection wouldn't be an option: https://docs.microsoft.com/en-us/powerapps/maker/canvas-apps/connections/connection-office365-users

[mjburley]

This is where Microsoft have not really thought through the Power Platform.

All the users come through into the Default environment as part of the whole citizen developer thing. Apps are developed in this environment (which MS clearly state is not to be used for production apps), but when you push an app to a CDS prod environment, suddenly you lose access to the users and the functionality that this implies (related records for example).

I cannot be the only one to run business centric apps in a CDS (non default) environment where all user visibility is key? Anyway, not the place to rant, I will raise an Idea 🙂