Small and medium business | Business Central, N...

Permissions in Security Groups dont show up when copying an Environment from Sandbox to Sandbox

(7) Share

Report

Posted on by Hatimali84

679

Hi all,

I am getting into this weird configuration issue.

Whenever I create a copy of any sandbox or environment, the security groups permissions vanish. I have to copy them over again. Does anyone know what the issue could be.

Regards,

Categories:

Dynamics 365 general

I have the same question (0)

All responses (9)

Answers (0)

Sort by

Navneeth Nagrajan 2,618 Super User 2026 Season 1 on at

Like (2)

Report
Copy link

Link copied!

Hi Hatimali84,

Question:

Which suite of product are we referring to here in the Dynamics 365 suite of products: Finance, Supply Chain, Human Resources, Customer engagement, Field Service, Sales etc.?

Was this reply helpful? Yes No
Hatimali84 679 on at

Like (2)

Report
Copy link

Link copied!

Its in Business Central D365

Was this reply helpful? Yes No
Jonas "Jones&q... 5,016 Most Valuable Professional on at

Like (3)

Report
Copy link

Link copied!

Moved from the General forum to the SMC forum that supports Business Central. Hope you don't mind.

Was this reply helpful? Yes No
Suggested answer

YUN ZHU 101,723 Super User 2026 Season 1 on at

Like (2)

Report
Copy link

Link copied!

I have not encountered this problem. Although there are the following restrictions when copying the environment, there is no mention of Security Groups.

When an environment is created as a copy of another environment, a number of precautions are taken for that copy:

https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/administration/tenant-admin-center-environments-copy?wt.mc_id=DX-MVP-5004336#environment-copies

It is recommended to submit a SR to Microsoft to assist in the investigation.

Thanks.

ZHU

Was this reply helpful? Yes No
Suggested answer

Hatimali84 679 on at

Like (3)

Report
Copy link

Link copied!

Hi All,

Thank you for your responses.

We figured out the issue.

It was happening because then environment i was copying had 7 companies and i was deleting 4 companies from it and the permissions were assigned to those 4 companies and when i deleted those companies it would delete the security group as well and then i had to import the security groups again.

I hope this helps.

Was this reply helpful? Yes No
Jun Wang 8,220 Moderator on at

Like (2)

Report
Copy link

Link copied!

Here is a nice video about security groups

https://youtu.be/DBriUxIYIEY

Was this reply helpful? Yes No
Hatimali84 679 on at

Like (3)

Report
Copy link

Link copied!

@JunWang, thanks for sharing the video, the issue was something else. When system cannot find that entity in the environment, it removes those security groups which were part of it

Was this reply helpful? Yes No
Suggested answer

Jainam M. Kothari 16,865 Super User 2026 Season 1 on at

Like (2)

Report
Copy link

Link copied!

May this can help : https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/administration/tenant-admin-center-manage-access

Was this reply helpful? Yes No
Suggested answer

Jeffrey Bulanadi 9,123 Super User 2026 Season 1 on at

Like (2)

Report
Copy link

Link copied!
Hi Hatimali,

You're absolutely right — copying a sandbox environment in Power Platform or BC doesn’t preserve security group associations by default, which leads to missing permissions post-copy.

Let’s break down what’s happening and what you can do:

Why security group permissions vanish after copying

When you copy an environment, the users and groups are duplicated, but security group associations are not retained

Users are not automatically re-added to the copied environment’s security group

Even if the group exists, its link to the environment must be manually re-established

This behavior is consistent across sandbox-to-sandbox and production-to-sandbox copies

What happens behind the scenes

The copied environment gets a new GUID and metadata

Security groups are tenant-level objects, but their environment-level bindings are not cloned

Users may appear in the environment but are marked as disabled until re-added to the correct group

Without a security role and group membership, users can’t access apps or data

How to resolve the issue Here’s a checklist to restore access:

Reassociate the security group manually Go to Power Platform Admin Center > Environments > Select copied sandbox > Edit > Security group Choose the correct Microsoft Entra security group and save

Run user diagnostics In the Admin Center, select a user > Run diagnostics This syncs Azure AD with Dataverse and resolves most access issues

Assign security roles again Even after group reassignment, users need at least one role (e.g., Environment Maker) to access the environment

Wait for sync or force login Sometimes users won’t appear until they log in to the environment You can also trigger sync by assigning a role or running diagnostics

Helpful references:

Environment copy behavior – Microsoft Docs
Control user access with security groups – Microsoft Docs
Why users can’t see environments – Michael Roth Blog

If you find this helpful, feel free to mark this as the suggested or verified answer.

Cheers
Jeffrey

Was this reply helpful? Yes No