Latency issue between Azure AD Security Groups and Environments Teams

(0) Share

Report

Posted on by AhmedSalih

Hello,

I have created Azure AD security groups for my Dataverse security model (Field based security using Environment Teams). I then created Environments Teams for those AAD security groups and assigned security roles for those teams. It has been more than 24 hours and I still don't see the Teams members in the Environment?!!

Thank you

I have the same question (0)

All responses (6)

Answers (1)

Suggested answer

AhmedSalih 7 on at

Like (0)

Report

I asked in another community form and I got the answer. Here it is powerusers.microsoft.com/.../1548067

Was this reply helpful? Yes No
Verified answer

PerezAguiar Microsoft Employee on at

Like (0)

Report

Hey Ahmed.

Official documentation: https://docs.microsoft.com/en-us/power-platform/admin/manage-teams#about-group-teams

Team members are dynamically derived (added and removed) when they access an environment based on their Azure AD group membership

This means that even if you Create a group on AzureAD and create a Team within the environment associated to those AAD Groups, they're not going to automatically populate with the users. Instead, as users login to the environment, they will show on the list.

Regards,

Was this reply helpful? Yes No
MaSc4Crm 6 on at

Like (0)

Report

Hi,

when does the changes in the Azure AD (e.g. an user from a group) takes place in D365?

E.g. an user is still working with CRM and is already logged in.

Regards,

Martin

Was this reply helpful? Yes No
Suggested answer

PerezAguiar Microsoft Employee on at

Like (0)

Report

Hey! This will depend on many factors.

Usually when you login, a token is submitted and you're authenticated using that token. If you're removed from the security groups, that token might still be valid for some time (24 hrs, 7 days, 1 hr). this will depend on AzureAD.

On CRM, you can take advantage of Access Management and establish some Session Time Out and INactivity timeout. If the token changes removing the access and the user hits one of those timeouts (Session or inactivity), they will be logged off.

learn.microsoft.com/.../user-session-management

Regards,

Was this reply helpful? Yes No
MaSc4Crm 6 on at

Like (0)

Report

Hi Daniel,

this means - I need to setup an automatic "expiring/inactivity" rule for each D365 environment - this is the only option.

Can I force the user by code to re-login e.g. by revoke the token?

Can I force the user by using "a button" to re-loging?

Regards,

Martin

Was this reply helpful? Yes No
Suggested answer

PerezAguiar Microsoft Employee on at

Like (0)

Report

Hey!

When you configure the Inactivity & Session TimeOut, users receive a warning and are requested to login again

community.dynamics.com/.../setup-inactivity-timeout-in-microsoft-dynamics-365-online

Was this reply helpful? Yes No