Using Security Groups to Limit Users in Dynamics (Work 365)

Applies To: Microsoft Dynamics 365 / Dataverse, Work 365
Audience: System Administrators, IT Governance Teams, Licensing Managers

Overview

In Work 365 environments on Microsoft Dynamics 365/Dataverse, you can restrict which licensed users are enabled in an environment by associating a Microsoft Entra ID (Azure AD) security group with that environment. Only users in the assigned security group get enabled in Dynamics. Work 365 license usage then counts only active, enabled users with read/write access.

When to Use This

• Limit active Work 365 users to remain within your licensed tier.

• Restrict access to specific teams (Billing, Support, Admin).

• Separate access across environments (Production, Sandbox, Training).

Reference: Work 365 Support Portal – Security Group Configuration

Prerequisite: Global Administrator privileges in your Microsoft 365/Entra ID tenant.

Steps to Configure Access via Security Groups

Step 1: Create a Security Group in Microsoft 365/Entra

1. Go to portal.office.com or the Microsoft 365 Admin Center.

2. Navigate to Groups → Add a group.

3. Choose Type = Security Group.

4. Enter a Name and Description (e.g., Work365_Users).

5. Add all users who should have access to the Work 365 environment.

6. Save.

Tip (naming):

• Work365-Prod-Users

• Work365-Sandbox-Users

Step 2: Assign the Security Group to the Dynamics/Work 365 Environment

1. Open the Power Platform Admin Center: admin.powerplatform.microsoft.com.

2. Environments → select your target environment → Edit.

3. Under Security group, select the group you created.

4. Save.

Result: Only users in the group (with valid Dynamics licenses) are enabled in the environment.

Effect

• Condition: User is in the assigned security group and licensed Result: Enabled in environment
• Condition: User is licensed but not in the group Result: Disabled automatically
• Condition: Admin user excluded from group Result: May retain global admin access; add to group for consistency
• Condition: Work 365 license count Result: Reflects enabled users only

More info: Microsoft Learn – Control user access to environments by using security groups

Impacts & Considerations

• Scenario: Assigning a group to an existing environment with many users Impact / Action: Users not in the group are automatically disabled
• Scenario: System Admins not in the group Impact / Action: They can still access as global admins, but should be added for visibility
• Scenario: Environment-level access Impact / Action: Group controls who can access; Dynamics roles still define privileges
• Scenario: Work 365 license usage Impact / Action: Counts enabled users only

Note: Using security groups simplifies governance—adding/removing users in the group updates access without manual user enable/disable in Dynamics.

Best Practices

• Naming: Use environment-based names (Work365-Prod-Users, Work365-Dev-Users).

• Layered Security: Combine group access (entry) with Dynamics roles (privileges).

• Periodic Reviews: Audit group membership quarterly; remove inactive users.

• Separate per Environment: Distinct groups for Prod, Sandbox, Training.

• Document: Track group names, mapped environments, and admin contacts.

Troubleshooting

• Issue: “You can’t access this environment.” Cause: User not in assigned security group Resolution: Add the user to the correct group and retry
• Issue: Users remain enabled after removal Cause: Directory sync delay or cache Resolution: Wait for sync or manually disable user in Dynamics
• Issue: All users disabled after assignment Cause: Group missing required members Resolution: Verify membership; add admins/service accounts
• Issue: License count not reduced Cause: Old users still marked enabled Resolution: Review users and disable stale accounts