Security group on environment level, but I want all employees as systemusers.

(4) Share

Report

Posted on by Sunilkumar

I have a Dataverse environment/app where I want to restrict access at the environment level using a security group. However, I still want all users in the organization to be synced as users (so that I can use lookups against the user table without needing a custom user table).

With a security group, users are only created as users once they log in for the first time. If I create the environment without a security group, all users are synced. I can add the security group afterward, but then new employees will not be added.

Is there a good solution to this problem?

Categories:

Microsoft Dynamics CRM

Dynamics 365 Sales

I have the same question (0)

All responses (2)

Answers (1)

Suggested answer

Tom_Gioielli 2,762 Super User 2025 Season 2 on at

Like (0)

Report

I'm not sure on an approach for the User table, but have you considered using the AAD User table for your lookup references instead? This is a virtual table that should include all possible users in your org, and would prevent the need to try and brute force everyone into the System User table (which is a bit of a black box and, as you have discovered, difficult to force it to contain all users).

Announcing the AAD User Virtual Table - Find and add any AAD user to your records. - Microsoft Power Platform Blog

Was this reply helpful? Yes No
Verified answer

Daivat Vartak (v-9d... 7,835 Super User 2025 Season 2 on at

Like (1)

Report
Hello Sunilkumar,

You've identified a classic challenge in Dataverse environment security: balancing tight access control with the need for comprehensive user data for lookups. Here's a breakdown of the problem and potential solutions:

The Problem:

Security Groups: When you secure a Dataverse environment with a security group, only users within that group who attempt to access the environment are provisioned as users in Dataverse. This limits access but hinders the ability to use lookups against all organization users.

No Security Group: Without a security group, all users are synced, providing comprehensive user data but granting potential access to the environment to everyone.

Adding Security Group Later: Adding a security group after initial sync doesn't address the ongoing issue of new employees not being automatically provisioned.

Solutions and Workarounds:

Power Automate User Provisioning:

How it Works: Create a Power Automate flow that triggers when a new user is created in Azure Active Directory (Azure AD).

Flow Steps:

Trigger: "When a user is created (V3)" in Azure AD.

Action: "Add user to an environment" (Dataverse connector).

Configure the action to add the new user to your Dataverse environment.

Configure action to assign a security role that has no access to data.

Advantages:

Automates user provisioning, ensuring all users are created in Dataverse.

Allows you to maintain environment-level security with a security group.

Considerations:

Requires Power Automate skills.

You will need to assign a security role that has no access to data, to prevent unathorized data access.

Azure Logic Apps:

Azure Logic Apps can also be used to create a process similar to the Power Automate solution.

It is very similar to Power automate, but runs directly in azure.

Recommendation:

The Power Automate user provisioning solution is generally the most practical and efficient. It allows you to automate user creation while maintaining environment-level security.

Make sure to create a security role that has absolutely no access to any data, and assign it to the users that are added by the power automate flow.

If my answer was helpful, please click Like, and if it solved your problem, please mark it as verified to help other community members find more. If you have further questions, please feel free to contact me.

My response was crafted with AI assistance and tailored to provide detailed and actionable guidance for your Microsoft Dynamics 365 query.

Regards,

Daivat Vartak

Was this reply helpful? Yes No

Join the conversation

Community site session details

Security group on environment level, but I want all employees as systemusers.

Helpful resources

Quick Links

Responsible AI policies

Neeraj Kumar – Community Spotlight

Congratulations to the November Top 10 Community Leaders!

Leaderboard > Customer experience | Sales, Customer Insights, CRM

Featured topics

Product updates

Community site session details

Security group on environment level, but I want all employees as systemusers.

Helpful resources

Quick Links

Responsible AI policies

Neeraj Kumar – Community Spotlight

Congratulations to the November Top 10 Community Leaders!

Subscribe to this forum!

Select categories

Leaderboard > Customer experience | Sales, Customer Insights, CRM

Featured topics

Product updates