Import users fails with "Authorization Required" even with System Administrator role in DevBox

(3) Share

Report

Posted on by Raed Bzour

188

Hi everyone,

I'm working on a Cloud-Hosted DevBox (Tier 1) environment and I'm having an issue with the Import users functionality.

Problem:
When I click Import users in:
System administration > Users > Users

I get "Authorization Required" error immediately — even though I am logged in as System Administrator.

What I understand is import users communicates with Azure AD outside of D365 and being System Administrator in D365 is not enough

Questions:

What exact Azure AD permissions are needed to enable Import users?

How to correctly configure the Azure AD app registration for a DevBox environment?

Is there a workaround to import users without Azure AD Global Admin access?

Thanks in advance.

Categories:

Dynamics 365 Finance

I have the same question (0)

All responses (9)

Answers (0)

Sort by

Raed Bzour 188 on at

Like (1)

Report
Copy link

Link copied!

hint: there are users, but I hid them

Was this reply helpful? Yes No
Suggested answer

André Arnaud de Cal... 304,713 Super User 2026 Season 1 on at

Like (2)

Report
Copy link

Link copied!

Hi Raed,

This is a known situation in the CHE environments. By default for security reasons the connection between the environment and Entra ID is not enabled. You can do this yourself.

Note that apart from importing the users, you can create the users manually. That will work as well.

To enable the import option, follow the steps in the next blog: Unable to import users in Cloud Hosted Environment – JohanPersson.nu

Was this reply helpful? Yes No
Suggested answer

11manish 694 on at

Like (2)

Report
Copy link

Link copied!
The Import Users feature depends on Azure AD directory access, not D365 roles.

Required permission: Directory Readers (Entra ID role)

App registration setup: Not required in DevBox (already handled by platform)

Workaround without Global Admin:

Assign Directory Readers role to your user

Was this reply helpful? Yes No
Raed Bzour 188 on at

Like (1)

Report
Copy link

Link copied!

Hi André ,

Thank you for your response. I followed the steps for manually creating a new user — I filled in the same data as Azure AD, assigned a person, added the Tenant ID in the provider field, and assigned the System Administrator role.

However, the user still cannot log in and gets the "not authorized" error.

I also noticed that the Telemetry ID is showing as {00000000-0000-0000-0000-000000000000}, which I believe indicates the user is not properly linked to Entra ID.

Do you have any suggestions on how to resolve this?

Thank you.

Was this reply helpful? Yes No
André Arnaud de Cal... 304,713 Super User 2026 Season 1 on at

Like (2)

Report
Copy link

Link copied!

Hi Raed,

Is this a user account in your tenant or is it an external user?

Was this reply helpful? Yes No
André Arnaud de Cal... 304,713 Super User 2026 Season 1 on at

Like (2)

Report
Copy link

Link copied!

@11manish, Are you aware that this question is about Dynamics 365 F&O?

Was this reply helpful? Yes No
Raed Bzour 188 on at

Like (1)

Report
Copy link

Link copied!

Hi Andre,

This is an internal user account within our tenant.

Was this reply helpful? Yes No
André Arnaud de Cal... 304,713 Super User 2026 Season 1 on at

Like (1)

Report
Copy link

Link copied!

When there is no typo in the email address and the provider field has the default value, the telemetry ID should be recognized.
Try to see if the steps provided in the above shared blog from Johan may solve this issue.

Was this reply helpful? Yes No
Suggested answer

Raed Bzour 188 on at

Like (0)

Report
Copy link

Link copied!

To solve the issue of manually inserting a user that exists in the tenant, first try to insert the user normally using the correct email address and try to log in.

If the login fails, use SSMS to find the record of the user you inserted and check the Object ID — in my case it was all zeros {00000000-0000-0000-0000-000000000000}, which is why the login was failing.

To solve this, go to the Azure Portal under Azure Active Directory → Users, get the Object ID for your user, then manually update the Object ID in the database. After that, you will find that the Telemetry ID will automatically be set to the Object ID and the user will be able to log in successfully.

This is how the manual user creation works.

I also found that this approach is easier than following the blog and granting the user permission to import users.

Was this reply helpful? Yes No