Edit

Work with Microsoft Entra ID group teams

A Microsoft Entra ID group team, similar to an owner team, can own records and can have security roles assigned to the team. To learn more about Microsoft Entra ID group teams, see Manage group teams.

Just-in-time updates

Just-in-time updates mean that the actions are taken at run-time to eliminate the need for syncing data from Microsoft Entra ID and Microsoft Dataverse. These actions include creating Microsoft Entra ID group teams, adding or removing Microsoft Entra ID group members from Microsoft Entra ID group teams, and adding users into Dataverse.

  1. If the Microsoft Entra ID group team doesn't exist and you assign a security role or assign a record to the Microsoft Entra ID group, the Microsoft Entra ID group team is created just-in-time.

  2. When a Microsoft Entra ID group member accesses Dataverse interactively or through a non-interactive process makes a call on behalf of the user, the group member is added into the Microsoft Entra ID group team at run-time. Similarly, when a member who was removed from the Microsoft Entra ID group accesses Dataverse interactively or by a non-interactive process call, the group member is removed from the Microsoft Entra ID group team.

  3. When a Microsoft Entra ID group member accesses Dataverse interactively or through a non-interactive process makes a call on behalf of the user, and the user doesn't exist in Dataverse, the user is added in Dataverse just-in-time.

The following sections describe how to work with Microsoft Entra ID group teams by using the Web API.

Impersonate another user

Your service can make calls on behalf of another system user by impersonating the user. If the system user belongs to a Microsoft Entra ID Security group and the Microsoft Entra ID security group is a Dataverse group team, that user is automatically added into Dataverse (if the user doesn't already exist in Dataverse). The user is also automatically added into the Dataverse group team after being added to Dataverse or if the user already exists in Dataverse.

Create a Microsoft Entra ID group team

You can create a Microsoft Entra ID group team in Dataverse by making an API call (programmatically) or by using just-in-time creation when you assign a security role to the Microsoft Entra ID group or assign a record to the Microsoft Entra ID group.

Citizen developers who want to programmatically create a Microsoft Dataverse Microsoft Entra ID group team can do so by providing the object ID of an existing Microsoft Entra ID group as shown in the following command.

Request:

POST [Organization URI]/api/data/v9.0/teams
Accept: application/json

{
  "azureactivedirectoryobjectid":"<group object ID>",
  "membershiptype":0
}

Where:

  • You define the membership type in the Team table MembershipType column.
  • The name of the team is the name of the Microsoft Entra ID group.
  • The team type is based on the Microsoft Entra ID group type, such as "Security" or "Microsoft 365".

Assign a security role to a Microsoft Entra ID group team

An administrator can assign a security role to a Microsoft Entra ID group team after the administrator creates the Microsoft Entra ID group in Microsoft Entra ID. If the Microsoft Entra ID group team doesn't exist in Dataverse, the system automatically creates it.

Request:

POST [Organization URI]/api/data/v9.0/teams(azureactivedirectoryobjectid=<group team ID>,membershiptype=0)/teamroles_association/$ref
Accept: application/json

{ 
  "@odata.id":"[Organization URI]/api/data/v9.0/roles(<role ID>)"
}

Assign a security role to a user

An administrator can assign a security role to a Microsoft Entra ID group user. If the user doesn't exist in Dataverse, the system automatically adds the user when you assign the role directly to the user.

Request:

POST [Organization URI]/api/data/v9.0/systemusers(azureactivedirectoryobjectid=<user object ID>)/systemuserroles_association/$ref
Accept: application/json

{ 
  "@odata.id":"[Organization URI]/api/data/v9.0/roles(<role ID>)"
}

Assign a record to an Microsoft Entra ID group

An administrator can assign a record to an Microsoft Entra ID group. If the Microsoft Entra ID group team doesn't exist in Dataverse, the group team is created automatically.

The following example shows the syntax for assigning an account record.

Request:

PATCH [Organization URI]/api/data/v9.0/accounts(<account ID>)
Accept: application/json

{ 
  "ownerid@odata.bind": "[Organization URI]/api/data/v9.0/teams(azureactivedirectoryobjectid=<group object ID>,membershiptype:0)"
}

Assign a record to a Microsoft Entra ID group member

An administrator can assign a record to a Microsoft Entra ID group member. If the user doesn't exist in Dataverse, the Microsoft Entra ID group member is added automatically.

The following example shows the syntax for assigning an account record.

Request:

PATCH [Organization URI]/api/data/v9.0/accounts(<account ID>)
Accept: application/json

{ 
  "ownerid@odata.bind": "[Organization URI]/api/data/v9.0/systemusers(azureactivedirectoryobjectid=<user object ID>)"
}

Retrieve a user

You can retrieve a system user table row by using an Azure user object identifier (ID). If the system user doesn't exist in Dataverse, the user is added to Dataverse automatically. If the user belongs to a Microsoft Entra ID group that exists in Dataverse, the user is also added to the Dataverse group team. If the user exists in Dataverse, the user isn't added to the Dataverse group team.

The following example shows the syntax for retrieving a user row.

Request:

GET [Organization URI]/api/data/v9.0/SystemUser(azureactivedirectoryobjectid=<user object ID>)

Security roles and privileges

Members of a Microsoft Entra ID group can query all the security roles that are directly and indirectly assigned to them by using the following command.

Request:

GET [Organization URI]/api/data/v9.0/RetrieveAadUserRoles(DirectoryObjectId=<user object ID)?$select=_parentrootroleid_value,name

Response:

{
  "@odata.context": "https://contoso.crm2.dynamics.com/api/data/v9.0/$metadata#roles",
  "value": [
    {
      "@odata.etag": "W/\"1649865\"",
      "name": "System Administrator",
      "roleid": "ae0daa93-e566-eb11-bb2b-000d3ac4c3f6",
      "_parentrootroleid_value": "ae0daa93-e566-eb11-bb2b-000d3ac4c3f6",
      "t_x002e_azureactivedirectoryobjectid": "e1341054-98ed-489b-a522-15e9e277b737",
      "t_x002e_membershiptype": 0,
      "t_x002e_teamid": "26e477f8-3f6a-eb11-bb2b-000d3af6caae",
      "t_x002e_name": "testgroup"
    }
  ]
}

Members of a Microsoft Entra ID group can check their security privileges without being a user of Dataverse by using the following command.

Request:

GET [Organization URI]/api/data/v9.0/RetrieveAadUserPrivileges(DirectoryObjectId=<user object ID>)

Response:

{
  "@odata.context": "https://contoso.crm2.dynamics.com/api/data/v9.0/$metadata#Microsoft.Dynamics.CRM.RetrieveAadUserPrivilegesResponse",
  "RolePrivileges": [
    {
      "Depth": "Global",
      "PrivilegeId": "0a620778-3e9f-46ec-9766-000624db57ba",
      "BusinessUnitId": "aa0daa93-e566-eb11-bb2b-000d3ac4c3f6",
      "PrivilegeName": "prvDeleteHierarchyRule"
    },
    …
   ]
}

Checking user or team's access rights on a record

If you have a non-interactive process where your service needs to check if the user has access rights to a record, you can make a RetrievePrincipalAccess function call on behalf of the user by specifying the CallerID.

More information: Impersonate another user

Triggering an event when a team member is added or removed from the group team

Group members are added or removed just-in-time into the Dataverse group team using the associate and disassociate APIs. You can register a plug-in on the event triggered by these team member additions or removals from the group team.

Auto-sync and refresh group team members

Automatically synchronize Dataverse group team membership with its associated Microsoft Entra group by using a scheduled process, such as a Power Automate Scheduled cloud flow. Configure the flow to run at a desired interval (for example, every hour) and use a Dataverse bound action to invoke the SyncGroupMembersToTeam action against the target group team table row (record) in Row ID of the flow.

Each synchronization refreshes the Dataverse group team membership to match the associated Entra group. New Entra group members are added to the team, and removed members are removed from the team.

Note

Team member synchronization is limited to Entra group members that are already provisioned in Dataverse. Any new Entra group members must be created in Dataverse before they can be included in the synchronization process.

See also

Manage app and resource access using Azure Active Directory groups

  • Last updated on