Control user access to environments with security groups and licenses

If your company has multiple environments, use security groups to control which licensed users can be members of a particular environment.

Consider the following example scenario:

In this example, four security groups provide controlled access to a specific environment.

Note the following information about nested security groups:

Members of a security group nested within an environment security group aren't pre-provisioned or automatically added to the environment. There are a couple of ways to add members to an environment:

• Create a Dataverse group team for the nested security group and assign a security role to the team.
• Have a member of the nested security group access the environment for the first time. This action adds the member to the environment at run time, but the member still can't run model-driven apps or access Dataverse data until you assign a security role to them.

Nested security group scenario: Suppose you assign a security group when you create an environment. Later, you want to add users who are managed through another security group. You create a Microsoft Entra security group named Managers and add your managers to it. You then add the Managers security group as a child of the environment security group, create a Dataverse group team for Managers, and assign a security role to the group team so the managers can access Dataverse.

Note the following information about security groups:

• When you add users to the security group, you add them to the environment.
• When you remove users from the group, you disable them in the environment.
• When you associate a security group with an existing environment that has users, you disable all users in the environment who aren't members of the group.
• If you associate a security group with an environment, only users with an eligible Power Platform or Dynamics 365 license or per-app plan who are members of the environment security group are created as users in the environment.
• You can't assign security groups to default and developer environment types. If you already assigned a security group to your default or developer environment, remove it. The default environment is intended to be shared with all users in the tenant and the developer environment is intended for use by only the owner of the environment.
• Environments support associating the following group types: Security and Microsoft 365. Associating other group types isn't supported.
• When you select a security group, select a Microsoft Entra security group and not one created in on-premises Windows Active Directory. On-premises Windows AD security groups aren't supported.
• If a user isn't part of the assigned security group to the environment, but has the Power Platform Administrator role, the user shows as an active user and can sign in.
• If a user is assigned to the Dynamics 365 administrator role, then the user must be part of the security group before they're enabled in the environment. They can't access the environment until they're added to the security group and enabled.
• All your application users can run in any environments that are secured with a security group, without being a member of the security group.

Review admin roles you need to complete different tasks

Managing security groups often involves multiple roles. This table shows the least-privileged role necessary to complete each task.

Important qualifications:

• A Dynamics 365 Administrator must belong to the environment's security group. This restriction doesn't apply to Global Administrators or Power Platform Administrators.
• Power Platform, Dynamics 365, and Global Administrators are no longer automatically assigned the Dataverse System Administrator role. They must self-elevate before assigning Dataverse roles.
• Power Platform and Dynamics 365 administrators can't create users, manage Entra groups, or assign licenses solely through their service-admin role.

Create a security group and add members to the security group

1. Sign in to the Microsoft 365 admin center.
2. Select Teams & groups > Active teams & groups.
3. Select + Add a group.
4. Change the type to Security group, add the group Name and Description, and then select Add > Close.
5. Select the group you created, and then next to Members, select Edit.
6. Select + Add members. Select the users to add to the security group, and then select Save > Close several times to return to the Groups list.

To remove a user from the security group, select the security group and then, next to Members, select Edit. Select - Remove members, and then select X for each member you want to remove.

Create a user and assign license

1. In the Microsoft 365 admin center, select Users > Active users > + Add a user.

2. Enter the user information, select licenses, and then select Add.

   More information: Add users and assign licenses at the same time

Or, purchase and assign per-app passes: About Power Apps per app plans

Associate a security group with an environment

1. Sign in to the Power Platform admin center as an admin (Dynamics 365 administrator or Power Platform administrator).

2. In the navigation pane, select Manage.

3. In the Manage pane, select Environments, and then choose the environment with which you want to associate the security group.

4. Select Edit.

5. In the Edit details pane, select the Edit icon in the Security group area.

   

   The first 200 security groups are returned. Use Search to look for a specific security group.

6. Select a security group, select Done, and then select Save.

   The security group is associated with the environment.

Related content

Create users Manage Microsoft Entra groups and group membership