User and Access Management in Systems
View All Tags
When someone can't open an app in an environment, the Power Platform admin center can check the usual causes for you. Run diagnostics looks at one person's sign-in, license, group membership and roles, and says what to fix. This guide runs it and reads the results, including one that looks like a problem and isn't.
Before someone can open an app in an environment with Dataverse, they need a user record in that environment. Many people get one automatically, but not everyone and not in every environment. This guide adds one person by hand in the Power Platform admin center, so their first visit just works.
In an environment with Dataverse, people need a security role before they can use its data. Instead of giving the role to each person, give it to a Microsoft Entra group once, with a group team: everyone in the group gets the role, and new members get it automatically. This guide creates one and gives it Basic User.
Security groups are how access follows people. Give a group access to an app or a site once, and everyone you add to the group gets it. This guide adds a new joiner to an existing group in the Microsoft Entra admin center, step by step.
When someone leaves, the first thing to do with their account is stop it being used. Block sign-in does exactly that: nobody can sign in as the person, and their mailbox, files and data stay where they are. This guide blocks a leaver in the Microsoft 365 admin center, shows what he sees when he tries to sign in, and does the same with PowerShell.
I changed someone's job title in the Microsoft Entra admin center, got Successfully updated, and the Properties tab still showed the old title. The save had worked; the page hadn't caught up. Reloading the browser page fixed it.
When someone leaves, Microsoft's offboarding steps sign them out of everything and block their sign-in. I blocked first, and the Microsoft 365 admin center then stopped offering Sign out of all sessions. Microsoft Entra's Revoke sessions still worked.
A Microsoft 365 license is a bundle of apps and services. To see what a user actually has, open their Licenses and apps tab in the Microsoft 365 admin center: it shows each license and every app it switches on, such as Power Apps for Office 365.
Being a Global or Power Platform admin doesn't make you System Administrator of an environment's Dataverse. Microsoft stopped assigning that role to admins automatically. When you need it, you give it to yourself in the Power Platform admin center, in four clicks.
Giving a team access to something one person at a time works until someone joins or leaves. Then you're editing access in five places. A security group fixes that: you give access to the group once, and from then on you only change who is in it.
