Users with "Global Admin" in Azure gets System Administrator role in D365 without beeing revoked

(0) Share

Report

Posted on by Adam A

Hi,

We have D365 CRM which is configured to use Azure AD (Entra ID) connected groups for access management. In our Azure tenant we have a few Global Administrators whom can elevate this role upon request via PIM. Something we noticed is when a user has the Azure Global Administrator role they also get the System Administrator role in D365. However, The System Administrator role is never removed despite the Global Administrator role has expired/been revoked. I would expect and assume if a users Global Administrator role is revoked then the System Administrator role in D365 is revoked as well.

I now wonder:

1) Shouldn't the System Administrator role be automatically removed if a Global Admin role has been revoked in Azure?

2) Is there a way to disable this behavior in D365?

I have the same question (0)

All responses (2)

Answers (1)

Verified answer

PerezAguiar Microsoft Employee on at

Like (1)

Report

Hey!

This is documented on Microsoft's site. on https://learn.microsoft.com/en-us/power-platform/admin/use-service-admin-role-manage-tenant you have a table that states the roles from the tenant what kind of permissions get on PowerPlatform environments, and a warning that states the SystemAdmin role is NOT removed to those users:

Best regards,

******
I hope this answer has helped you solve your problem. If you are satisfied with it, please consider marking it as the excellent answer by clicking on the green check mark below. This will help other users who have similar questions find the best solution.

Thank you for your feedback!

Was this reply helpful? Yes No
Adam A 75 on at

Like (0)

Report

Thanks PerezAguiar, missed that note.

Believe this is really bad to not maintain this on D365 side, anyhow thanks for sharing the link.

Was this reply helpful? Yes No