cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
xmihux
Frequent Visitor

Environment access through AAD Security (or Office) Group Team

Hi,

 

I have been testing providing access to a Power Platform environment (with CDS) by adding users to a certain AAD group. The Group is linked to an AAD Office Group Team created on Dynamics 365 level. Documentation on this can be found here: https://docs.microsoft.com/en-us/power-platform/admin/manage-teams#about-group-teams

In theory it works fine and after a user logs into the environment, I can see he is added to the team. The team has been assigned 'Environment Maker' role. 

 

The problem is that if I go to either Power Apps or Power Automate portal, I can't see the environment I got access to. I can access it by a direct link with environement ID and e.g. create a Flow, so access works, but it's not possible to switch to that environment from the default one through the UI. It's just not visible. I waited over 24 hours.

 

If I assign Environment Maker role to a user directly, then the environment shows up. 

 

I don't think it should work like this and I would assume it's a bug, but maybe someone experienced a similar issue and found a solution for this?

2 ACCEPTED SOLUTIONS

Accepted Solutions

so here is a small detail in the instructions--users are not added as an active user until the user logs in to a model-driven app for the first time. Just logging in to a canvas app doesn't seem to do it

 

nothing "syncs" in this scenario, so it doesn't matter how long you wait. it simply adds the user to the team when they first log in to a model-driven app.

 

also make sure the role associated with the aad team is set to function like delegated security. on the security role first tab there is a drop-down. change that to basic security.

 

Also, the seeing the environment may be a different issue--we've seen multiple people report (outside of the team security) that they have issues seeing environments that they have been given access to. Sometimes things get cached on the Power Apps side. the solution for me is to have someone in the environment share an app with me, and then after I access the app, I can see the environment from the environment selector.

 

another thing that worked in on situation was going to home.dynamics.com and clicking the refresh button at the top of the screen.

 

If all of this doesn't work, create a support ticket.

 

@xmihux if this answers your question, please mark it a solution.

View solution in original post

MarkPP
Helper II
Helper II

I have had similar issues and worked with Microsoft around it. However, currently when using AAD Groups (Unified or Security) and you assign the Environment Maker role to the Team it wont show in the environment selector. As per the article you linked to there is a note

 

System Administrator and Environment Maker security roles. These are special administrator's security roles and they need to be assigned to the user directly. If these security roles are assigned to Group teams, team members get the team privileges only and won't have any direct/inherited privileges. Team members won't be able to perform all the system administrator and environment maker functions. In addition they won't be able to see the list of all the environments in their tenant.

 

Hope this helps.

View solution in original post

7 REPLIES 7

so here is a small detail in the instructions--users are not added as an active user until the user logs in to a model-driven app for the first time. Just logging in to a canvas app doesn't seem to do it

 

nothing "syncs" in this scenario, so it doesn't matter how long you wait. it simply adds the user to the team when they first log in to a model-driven app.

 

also make sure the role associated with the aad team is set to function like delegated security. on the security role first tab there is a drop-down. change that to basic security.

 

Also, the seeing the environment may be a different issue--we've seen multiple people report (outside of the team security) that they have issues seeing environments that they have been given access to. Sometimes things get cached on the Power Apps side. the solution for me is to have someone in the environment share an app with me, and then after I access the app, I can see the environment from the environment selector.

 

another thing that worked in on situation was going to home.dynamics.com and clicking the refresh button at the top of the screen.

 

If all of this doesn't work, create a support ticket.

 

@xmihux if this answers your question, please mark it a solution.

Thanks a lot for all your suggestions.

 

Showing up as an active user is not an issue here - that works fine once the user opens environment URL. 

I tried everything you mentioned, including changing the value in the drop down of the security role, sharing a model driven app, but nothing makes the environment appear in the top right menu selection in either of the portals (Power Apps / Power Automate) unless the role is given to the user directly. 

 

I could try another approach...Would you know if there is any easy way to assign a D365 security role directly to a user with Power Automate? Any REST APIs? 

so just having app access doesn’t give you access to the maker portals in those environments. What role did you give the team and what permissions does it have for making apps and flows?

The team has 'Environment Maker' role. The user who is a member of the team can create apps and flows in the environment. It just doesn't show up.

Share an app with them as co owner. Just a simple canvas app should do. Have them go to the app from the link in the email. That’s what did it for me

MarkPP
Helper II
Helper II

I have had similar issues and worked with Microsoft around it. However, currently when using AAD Groups (Unified or Security) and you assign the Environment Maker role to the Team it wont show in the environment selector. As per the article you linked to there is a note

 

System Administrator and Environment Maker security roles. These are special administrator's security roles and they need to be assigned to the user directly. If these security roles are assigned to Group teams, team members get the team privileges only and won't have any direct/inherited privileges. Team members won't be able to perform all the system administrator and environment maker functions. In addition they won't be able to see the list of all the environments in their tenant.

 

Hope this helps.

@jlindstrom Sharing a model driven app finally worked for Power Apps portal, but the environment is still not visible from Power Automate portal, even if I share a Flow. Well, I think the topic is quite exhausted now with the additional input from @MarkPP . Not sure why I omitted this info in the documentation 😉 Thank you Both!

Helpful resources

Announcements
Power Apps News & Annoucements carousel

Power Apps News & Announcements

Keep up to date with current events and community announcements in the Power Apps community.

Community Call Conversations

Introducing the Community Calls Conversations

A great place where you can stay up to date with community calls and interact with the speakers.

Power Apps Community Blog Carousel

Power Apps Community Blog

Check out the latest Community Blog from the community!

Users online (4,017)