Using Azure Active Directory groups to give access to Power Apps applications.

Many of you have questions about giving access to a Power Apps application from Azure Active Directory groups.

• How do we manage access to a model app in Power Apps from AAD?
• How can we assign a role in Dataverse to a user? Without doing it for each active user.
• Where can I find the AAD security groups on the Power Platform Administrator page?
• Can we have multiple roles assigned to AAD groups?
• Which type of groups can we use? Security – or Microsoft 365 groups?

Let us talk first then about the types of groups that exist in AAD?

Azure AD Security Groups

What are they?

AAD security groups are similar to security groups from an on-premise Windows Active Directory. It’s a security principle, so you can use it to secure objects in AAD. Security groups can be created in AAD or synced from an on-premises Windows AD with AAD Connect. Members can be static, or they can be generated dynamically with rules.

How are they used?

AAD security groups aren’t often used in Microsoft 365. AAD security groups are mainly used to apply licenses to users and apply access to Power Apps – applications. Centralize access management for Power Apps – applications from AAD.

Azure AD Microsoft 365

What are they?

Microsoft 365 groups give us the possibility to easily have permissions to a group of related resources. Those resources vary depending on where the creation of the Microsoft 365 group has done. For example, creating a team site in SharePoint will create a Microsoft 365 group and at the same time, a shared mailbox, calendar in Outlook, Planner Plan and a Power BI workspace.

We can assign two roles to a Microsoft 365 Group:

• Owner
• Member

Owners can change settings and membership of the group.
Members can remove themselves, add members to a public group and invite guest users. 

How are they used?

Microsoft 365 groups allow active users to take advantage of the entire suite of Microsoft 365 applications with minimal administrative overhead. It gives group owners one pane of glass to see what their group is doing and can use Microsoft 365 groups to access Power Platform applications.

Apply Azure AD group to an environment in Power Platform

Step 1: Create a group in Azure AD
Go to Azure AD in the Azure Portal or open the Azure AD admin center.

Click “New Group”,

Step 3: Assign AAD group to a team in an environment in the Power Platform.

But first.

What are Teams?

Teams in Dataverse is a vital security building block. A business unit has a default team, and a business unit owns a team. There are two types of teams:

• Owning Teams can own records, which give any team member direct access to that record. Users can be members of multiple teams. It is a powerful way of granting permissions to users in a broadway without micromanaging access at the individual user level.
• Access teams provide auto-creation of a team and share record access with the team based on a template of permissions applied. You can also use it without the template of permissions; add/remove members manually. Access teams have a better performance because they don’t own records or have security roles assigned. Users get access because the record is shared with the team, where the user is a member.

How do we link an Azure AD group to a team in the Power Platform?

Go to the Power Platform admin center and open the environment where you would like to add the Azure AD group. You can use two ways to open “teams access” in the admin center.

1. Just click the environment that you would like to manage. Click in the Access panel on “See All” under Teams.
   
   
2. Click the three dots and click “settings”. Select “Users + permissions” and click “Teams”
   
   

Both ways will open the same window.

Click “Create team“

Team name: we will use the same name as the Azure AD group. For example: secgrp-app-managers
Description: Add a team description
Business unit: Select the business unit
Administrator: Assign to the person that has created the team
Team type: Select the type of the team. This is the part that where we select the Azure AD group type.

AAD Security Group or AAD Office Group ( = Microsoft 365 Group)
In this example, I have selected the AAD Security group.

• Members and guests: Member and guest of the security group
• Members: Only the members of the security group
• Owners: The owners of the security group
• Guests: Only the guests of the security group

• 

• 

Click “Next”
Step 4: Assign role to the team.

Select the role that you would like to assign to the team and click “save”.
This will create a new entry and a link to the Azure AD via a team.

Is possible to assign a second role to the team. Select the team and click “Manage security roles”

Select a second role and click “save”

Conslusion

We can indeed use Azure Active Directory groups to give access to a Power Platform application. Can use both security and Microsoft 365 groups. The environment needs to have a Dataverse database, and owning team is used. So that we can assign one or more roles to the created team, I hope this helps you and all commentaries are welcome.