As more people adopt the Power Platform, security becomes essential to prevent data leaks and operational issues. By applying two crucial levels of control, so you can manage the platform through Entra ID while maintaining clear oversight.
- Manage the platform using the appropriate roles.
- Control permission assignments across the enterprise.
Manage the platform through platform roles
When platform control is unclear, it is important to know which roles can help you regain oversight. Three platform roles support tenant administration, each with its own responsibilities:
- The Dynamics 365 administrator role comes from earlier Dynamics environments, where administrators had full administrative permissions within their own environments. Users with this role can manage environments that are linked to security groups they belong to.
- The Power Platform administrator role can administer all Power Platform environments, regardless of security group membership.
- The Global Administrator role can manage all environments and oversee integrations with services such as Exchange and Teams.
Important: Avoid assigning these roles permanently. Use Azure PIM so users must request role activation when needed, ensuring privileged roles are used only when necessary.
Having one of these roles does not automatically make a user a System Administrator in every environment. Users must self-elevate their permissions when required, either through PowerShell or the Power Platform admin center.
More details Platform roles: https://learn.microsoft.com/en-us/power-platform/admin/use-service-admin-role-manage-tenant
More details PIM: https://learn.microsoft.com/nl-nl/entra/id-governance/privileged-identity-management/pim-configure
More details self-elevate: https://learn.microsoft.com/en-us/power-platform/admin/manage-high-privileged-admin-roles#self-elevate-through-power-platform-admin-center
Assign licenses to users
Assigning a license makes the user part of the platform. Licenses determine which default security roles users receive and which features they can access.
As a best practice, link licenses to specific Entra ID groups so you can precisely control who gets access to the platform.
Important: You can disable these default assignments to keep full control over access. Especially when you want full control over role assignment – don’t want permissions on users – this will become a must.
More details disabling security roles based on licenses: https://learn.microsoft.com/en-us/power-platform/admin/opt-out-automatic-license
Separate projects through environments
A tenant can contain multiple environments. The default environment is available to everyone by default, which makes it suitable as a playground. For production or project-specific work, environments should be used to keep solutions, data, and access isolated.
By default, environments are open: users are added automatically and receive security roles based on their license. Security groups let you restrict environment access to the intended users only. Each environment should have a security group linked to an Entra ID group that contains the users who need access.
More details security groups: https://learn.microsoft.com/en-us/power-platform/admin/control-user-access
More details securing the default environment: https://learn.microsoft.com/en-us/power-platform/guidance/adoption/secure-default-environment
Set-up departments through business units
Each environment can be divided into departments, just like a traditional organization. Instead of placing all data together, business units’ separate data by department so that users only see or act on the records relevant to their role.
Business units are already powerful, and modernized business units add more flexibility by allowing users to hold roles in multiple departments. Each role is linked to a business unit, and records are owned at the business-unit level. This means a user’s access and actions depend on both their assigned role and the related business unit.
One Important fact to keep in mind, there is always one business unit – the root business unit – which is linked to the entire environment.
More details modernized business units: https://learn.microsoft.com/en-us/power-platform/admin/modernized-business-units-security
Give users permissions in departments
Adding a user to an environment and assigning them to a department does not grant access by itself. The user needs a security role to perform actions, such as create, read, update, and delete records, or specific actions like exporting data to Excel.
Security roles can be assigned directly to users or to teams. Assigning roles to individual users may seem simple at first, but it quickly becomes difficult to manage in enterprise environments.
Group teams help solve this by linking a Dataverse team to an Entra ID group. When users sign in to Power Apps, they are added to the team and inherit the permissions assigned to it. Removing the users, will remove the user from the team the next time they login. This allows access to Power Apps to be managed centrally through Entra ID.
Warning: This mechanism is powerful, but it is still recommended to monitor role assignments in Dataverse as well, especially because the System Administrator role does not always apply to teams.
For these groups, permissions are assigned through teams. In the security role, it is important to define how privileges behave in relation to the team. The security role’s inheritance setting determines whether users can own records themselves. With Team privileges only, records must be owned by the team. With Direct User (Basic) access level and Team privileges, users can also own records directly.
More details predefined roles: https://learn.microsoft.com/en-us/power-platform/admin/database-security#environments-with-a-dataverse-database
More details group teams: https://learn.microsoft.com/en-us/power-platform/admin/manage-group-teams
More details: security role inheritance: https://learn.microsoft.com/en-us/power-platform/admin/security-roles-privileges#define-the-privileges-and-properties-of-a-security-role
Apply this through your organization based on roles
After defining the full access model, the final step is to apply it within your organization. Dataverse manages user roles, while Entra ID should be used to create groups that match the specific roles in your organization.
These groups can be static, with users added manually when they join, or dynamic, where Entra ID automatically assigns users based on attributes such as role or job title.
By following these steps, role assignments can be managed automatically:
- Link security groups to environments to restrict access to approved users only.
- Use group teams so users receive the correct permissions when they sign in.
- Use dynamic groups so users are automatically added to the right security groups and group teams when they join the organization.
More details dynamic groups: https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership
