Provision Per-App Users in Dataverse Before Their First Login
Diesen Beitrag auf Deutsch lesen
Use a security-group trigger and the Power Platform for Admins Force Sync user action to provision per-app users before access errors occur.
TL;DR
In managed production environments using per-app licensing, users are added to Dataverse on demand rather than through background sync. Trigger Power Automate when a user joins the environment security group, then call Force Sync user with the environment ID and Entra object ID before first sign-in.
Original by Marcel Lehmann, on PowerPlatformTip. Read the original
This is our own summary, not a republication or full translation. Both publications are edited by Marcel Lehmann.
Governance takeaway
- Makers: Check that new per-app users appear in Dataverse before they launch the app, because missing SystemUser records can cause organization membership errors.
- Admins/CoE: Trigger Force Sync user from environment security-group membership and govern target environments with Environment Groups for consistent onboarding.
- Security/Compliance: Use the environment security group as the authoritative membership signal, and avoid role-assignable groups because the documented trigger does not support them.
- Leadership/Business: Expect faster onboarding without manual refreshes, while remembering that synchronization alone does not grant security-role privileges.
Frequently asked questions
How do I use Power Automate Force Sync user for per-app Dataverse users?
Trigger a flow when a user joins the environment security group, then call Force Sync user with the environment ID and Entra object ID.
Why are per-app licensed users missing from the Dataverse SystemUser table?
Per-app users in a Dataverse environment are added on demand, unlike Premium users picked up by periodic background synchronization.
Does Dataverse Force Sync user assign security roles automatically?
No. Force Sync user creates or updates the SystemUser record, while privileges still require a team-based or direct security-role assignment.