Customer Engagement & Dynamics CRM Forum

I've confirmed with an O365 Global Admin that none of these new users had been granted D365 licenses or O365 global admin rights. However, they appear in my Enabled Users view preset with the Insights User security role selected.

I've taken the step of removing this security role from each user, but I would like to stop the automated process in the future.

Anyone else experience this situation?

------------------------------
Patrick Wright, MCSA
Central Virginia CRMUG Chapter Leader
www.crmug.com/richmond

Marketing Technology Lead
Cherry Bekaert LLP
Richmond VA
pwright@cbh.com
------------------------------

Have you recently installed Insights?

Microsoft Insights | Targeting Business Intelligence for Microsoft Dynamics Workflow | InsideView

The security role appears to be for this solution, it's not an out of the box one. The installation guide states that it adds the role to all users  on setup, but I'm not sure if it continues to add it for new users when already installed.

I wouldn't think this solution can assign licences, or otherwise activate users who don't have a licence. Are you saying that these users are showing up in Dynamics 365, even without a licence assigned? That should only happen if they are an Office 365 admin (as you've stated), or if they've been set up with the access mode of "non-interactive".

------------------------------
Tom Pickles
CRM Support Analyst
Chess Digital
Edinburgh SC
------------------------------

Original Message:
Sent: 04-11-2018 02:29 PM
From: Patrick Wright, MCSA
Subject: O365 Users Appearing in D365 with Insights User Security Role

I've confirmed with an O365 Global Admin that none of these new users had been granted D365 licenses or O365 global admin rights. However, they appear in my Enabled Users view preset with the Insights User security role selected.

I've taken the step of removing this security role from each user, but I would like to stop the automated process in the future.

Anyone else experience this situation?

------------------------------
Patrick Wright, MCSA
Central Virginia CRMUG Chapter Leader
www.crmug.com/richmond

Marketing Technology Lead
Cherry Bekaert LLP
Richmond VA
pwright@cbh.com
------------------------------

Hi Patrick,

I'm not sure if this is the same thing or not, but I opened up a case with Microsoft last week about a similar issue. I found that around 124 users showed up as enabled in Dynamics, even though they didn't have licenses assigned. 

The Microsoft rep said the following...

"The reason the users synced into CRM relates to new features that we are implementing which integrates some of our applications with CRM. An example of this can be read here: https://blogs.msdn.microsoft.com/crm/2018/03/21/whats-new-in-the-dynamics-365-admin-center/ In order to disable the users from being synced into CRM you will need to disable the PowerApps/Flow/Common Data Services Viral Licenses in O365."

I found that removing the "Microsoft Flow Free" license from the user also removed them as an active user in Dynamics, confirming what the rep said.

I'm glad I found out why the users suddenly showed up, but feel Microsoft messaging could have been much better on the subject. That blog post doesn't mention a thing about users suddenly showing up as enabled in Dynamics.

------------------------------
Steve Platz
Commercial Excellence Technical Lead
LORD Corporation
Cary NC
------------------------------

Original Message:
Sent: 04-11-2018 02:29 PM
From: Patrick Wright, MCSA
Subject: O365 Users Appearing in D365 with Insights User Security Role

I've confirmed with an O365 Global Admin that none of these new users had been granted D365 licenses or O365 global admin rights. However, they appear in my Enabled Users view preset with the Insights User security role selected.

I've taken the step of removing this security role from each user, but I would like to stop the automated process in the future.

Anyone else experience this situation?

------------------------------
Patrick Wright, MCSA
Central Virginia CRMUG Chapter Leader
www.crmug.com/richmond

Marketing Technology Lead
Cherry Bekaert LLP
Richmond VA
pwright@cbh.com
------------------------------

​Good morning @Patrick Wright @Patrick Wright, MCSA!
We had the same thing happen on ​4/7 around noon. There was an insights patch installed in our environment at that time.
The common thread we found was that all of the users who appears in Dynamics 365 (even though they were not assigned a CRM license) had a MS Flow license.  We have a ticket open with MSFT about this, but have not heard back yet.

I will let you know what we find out!

Laura

------------------------------
Laura Mortick
Marketing Information Systems Manager
Terracon
Olathe KS
------------------------------

Original Message:
Sent: 04-11-2018 02:29 PM
From: Patrick Wright, MCSA
Subject: O365 Users Appearing in D365 with Insights User Security Role

I've confirmed with an O365 Global Admin that none of these new users had been granted D365 licenses or O365 global admin rights. However, they appear in my Enabled Users view preset with the Insights User security role selected.

I've taken the step of removing this security role from each user, but I would like to stop the automated process in the future.

Anyone else experience this situation?

------------------------------
Patrick Wright, MCSA
Central Virginia CRMUG Chapter Leader
www.crmug.com/richmond

Marketing Technology Lead
Cherry Bekaert LLP
Richmond VA
pwright@cbh.com
------------------------------
​

​This occurs in my system as well. It was a problem for us because the Insights role granted access to parts of Dynamics that I didn't want my some of my staff to access - specifically, the Insights role grants access to Business Process Flows.

Per Microsoft and InsideView when I talked with them mid 2017 there was no way to stop this. I worked with my developers to get a plugin that automatically removes the Insights role and assigns our custom roles.

------------------------------
Sarah Schneider
ECG Management Consultants
Seattle WA
------------------------------

Original Message:
Sent: 04-11-2018 02:29 PM
From: Patrick Wright, MCSA
Subject: O365 Users Appearing in D365 with Insights User Security Role

I've confirmed with an O365 Global Admin that none of these new users had been granted D365 licenses or O365 global admin rights. However, they appear in my Enabled Users view preset with the Insights User security role selected.

I've taken the step of removing this security role from each user, but I would like to stop the automated process in the future.

Anyone else experience this situation?

------------------------------
Patrick Wright, MCSA
Central Virginia CRMUG Chapter Leader
www.crmug.com/richmond

Marketing Technology Lead
Cherry Bekaert LLP
Richmond VA
pwright@cbh.com
------------------------------

Hi Patrick,
We saw something similar this week - a free flow licence was granted to some users in Office 365, which caused them to appear in our CRM list of active users. We have confirmed that removing the flow licence causes them to disappear.
In our case they appeared with no security roles assigned.

We would like to remove these extras as it causes confusion for our other users to see them in the list in CRM.

------------------------------
Jo Anslow
Information Systems Specialist
Granta Design
Cambridge
------------------------------

Original Message:
Sent: 04-11-2018 02:29 PM
From: Patrick Wright, MCSA
Subject: O365 Users Appearing in D365 with Insights User Security Role

I've confirmed with an O365 Global Admin that none of these new users had been granted D365 licenses or O365 global admin rights. However, they appear in my Enabled Users view preset with the Insights User security role selected.

I've taken the step of removing this security role from each user, but I would like to stop the automated process in the future.

Anyone else experience this situation?

------------------------------
Patrick Wright, MCSA
Central Virginia CRMUG Chapter Leader
www.crmug.com/richmond

Marketing Technology Lead
Cherry Bekaert LLP
Richmond VA
pwright@cbh.com
------------------------------

​I've actually seen this as well but I haven't really taken the time to investigate yet.

------------------------------
Jill Vazquez
Technical Specialist - CRM
Bioventus, LLC
Durham NC
------------------------------

Original Message:
Sent: 04-11-2018 02:29 PM
From: Patrick Wright, MCSA
Subject: O365 Users Appearing in D365 with Insights User Security Role

I've confirmed with an O365 Global Admin that none of these new users had been granted D365 licenses or O365 global admin rights. However, they appear in my Enabled Users view preset with the Insights User security role selected.

I've taken the step of removing this security role from each user, but I would like to stop the automated process in the future.

Anyone else experience this situation?

------------------------------
Patrick Wright, MCSA
Central Virginia CRMUG Chapter Leader
www.crmug.com/richmond

Marketing Technology Lead
Cherry Bekaert LLP
Richmond VA
pwright@cbh.com
------------------------------

Hi, Patrick,

After seeing your post, I did a quick security review.  Found where the O365 team had created a couple of global admins, so had to remove both the Insights role as well as the Systems Administration role.  However, the service accounts that never had a global admin role did not show up at all on the D365 side.

(Side note: we're on D365 sales and customer service along with O365.)

Is it possible the users you're seeing were accidentally set as global admins and then the role was removed?  Would that leave a ghost ID behind in D365?

Cheers,
Phyllis

------------------------------
Phyllis Eriksen
Manager - Projects and Product Services
Audimation Services, Inc.
Houston TX
------------------------------

Original Message:
Sent: 04-11-2018 02:29 PM
From: Patrick Wright, MCSA
Subject: O365 Users Appearing in D365 with Insights User Security Role

I've confirmed with an O365 Global Admin that none of these new users had been granted D365 licenses or O365 global admin rights. However, they appear in my Enabled Users view preset with the Insights User security role selected.

I've taken the step of removing this security role from each user, but I would like to stop the automated process in the future.

Anyone else experience this situation?

------------------------------
Patrick Wright, MCSA
Central Virginia CRMUG Chapter Leader
www.crmug.com/richmond

Marketing Technology Lead
Cherry Bekaert LLP
Richmond VA
pwright@cbh.com
------------------------------

All,

I understand that MS will grant access to CDS/CRM data at will.  What I want to know, is there a way from within CRM for me to create an Advanced Find that will show me only Users that are assigned a Dynamics 365 CE or Dynamics 365 Team license?  And the opposite as well, all Users that are not assigned a Dynamics 365 license?

Thanks in advance,

------------------------------
Jim Corriveau
A.W. Chesterton Company
Groveland MA
------------------------------

Original Message:
Sent: Apr 16, 2018 06:45 PM
From: Phyllis Eriksen
Subject: O365 Users Appearing in D365 with Insights User Security Role

Hi, Patrick,

After seeing your post, I did a quick security review.  Found where the O365 team had created a couple of global admins, so had to remove both the Insights role as well as the Systems Administration role.  However, the service accounts that never had a global admin role did not show up at all on the D365 side.

(Side note: we're on D365 sales and customer service along with O365.)

Is it possible the users you're seeing were accidentally set as global admins and then the role was removed?  Would that leave a ghost ID behind in D365?

Cheers,
Phyllis

------------------------------
Phyllis Eriksen
Manager - Projects and Product Services
Audimation Services, Inc.
Houston TX

Original Message:
Sent: 04-11-2018 02:29 PM
From: Patrick Wright, MCSA
Subject: O365 Users Appearing in D365 with Insights User Security Role

I've confirmed with an O365 Global Admin that none of these new users had been granted D365 licenses or O365 global admin rights. However, they appear in my Enabled Users view preset with the Insights User security role selected.

I've taken the step of removing this security role from each user, but I would like to stop the automated process in the future.

Anyone else experience this situation?

------------------------------
Patrick Wright, MCSA
Central Virginia CRMUG Chapter Leader
www.crmug.com/richmond

Marketing Technology Lead
Cherry Bekaert LLP
Richmond VA
pwright@cbh.com
------------------------------

Patrick,
We had the same issue in our environment but this was with Microsoft Project. We solved it it by creating  an AD Security Group and adding users only individuals with a D365 license as members and then applying that security group to the Dynamics 365 instance. That should remove any users form the environment that are not members of security group regardless what type of license they're assigned.

We also use this same process to restrict our Dev and QA environments to certain users.

Here's a blog post about creating and assigning security groups to Dynamics 365 instances

https://community.dynamics.com/365/b/d365demystified/posts/restrict-user-access-to-a-d365-instance-using-security-groups

------------------------------
Edrei Mpanduki
CRM Technical Analyst
Scottsdale AZ
------------------------------

Original Message:
Sent: Apr 11, 2018 02:29 PM
From: Patrick Wright, MCSE
Subject: O365 Users Appearing in D365 with Insights User Security Role

I've confirmed with an O365 Global Admin that none of these new users had been granted D365 licenses or O365 global admin rights. However, they appear in my Enabled Users view preset with the Insights User security role selected.

I've taken the step of removing this security role from each user, but I would like to stop the automated process in the future.

Anyone else experience this situation?

------------------------------
Patrick Wright, MCSA
Central Virginia CRMUG Chapter Leader
www.crmug.com/richmond

Marketing Technology Lead
Cherry Bekaert LLP
Richmond VA
pwright@cbh.com
------------------------------

Edrei,

Thanks for this, i understand that if i created the AD groups and assigned the group to the environment only the Users in the group would appear in the environment.

Does this include User Accounts pushed by MS, like "Checker Application, PowerApps" and "Support User"?

I still would like to see if there is a way to identify a User record as licensed or not through Advanced Find...

Thanks,



------------------------------
Jim Corriveau
A.W. Chesterton Company
Groveland MA
------------------------------

Original Message:
Sent: Nov 14, 2019 10:33 AM
From: Edrei Mpanduki
Subject: O365 Users Appearing in D365 with Insights User Security Role

Patrick,
We had the same issue in our environment but this was with Microsoft Project. We solved it it by creating  an AD Security Group and adding users only individuals with a D365 license as members and then applying that security group to the Dynamics 365 instance. That should remove any users form the environment that are not members of security group regardless what type of license they're assigned.

We also use this same process to restrict our Dev and QA environments to certain users.

Here's a blog post about creating and assigning security groups to Dynamics 365 instances

https://community.dynamics.com/365/b/d365demystified/posts/restrict-user-access-to-a-d365-instance-using-security-groups

------------------------------
Edrei Mpanduki
CRM Technical Analyst
Scottsdale AZ

Original Message:
Sent: Apr 11, 2018 02:29 PM
From: Patrick Wright, MCSE
Subject: O365 Users Appearing in D365 with Insights User Security Role

I've confirmed with an O365 Global Admin that none of these new users had been granted D365 licenses or O365 global admin rights. However, they appear in my Enabled Users view preset with the Insights User security role selected.

I've taken the step of removing this security role from each user, but I would like to stop the automated process in the future.

Anyone else experience this situation?

------------------------------
Patrick Wright, MCSA
Central Virginia CRMUG Chapter Leader
www.crmug.com/richmond

Marketing Technology Lead
Cherry Bekaert LLP
Richmond VA
pwright@cbh.com
------------------------------

Jim, user accounts like  Checker Application, Microsoft Flow are Application users and they're not affected by security groups they'll still be in the instance without adding them to the security group. 
As for a way to identify whether a user is assigned a license or what type of license us assigned using an Advanced find, I don't think that is possible.

However I have an idea that I haven't had a chance to test out, you could create a custom entity in Dynamics and pull that information in using Flow/Automate. There's a Get User Profile(V2) action and once of the properties you can specify is assignedLicenses, you could try that and see if it solves your problem.

Here's the documentation on the Get User Profile Action
https://docs.microsoft.com/en-us/connectors/office365users/#get-user-profile-(v2)


------------------------------
Edrei Mpanduki
Technical Analyst
Scottsdale AZ
------------------------------

Original Message:
Sent: Nov 15, 2019 10:03 AM
From: Jim Corriveau
Subject: O365 Users Appearing in D365 with Insights User Security Role

Edrei,

Thanks for this, i understand that if i created the AD groups and assigned the group to the environment only the Users in the group would appear in the environment.

Does this include User Accounts pushed by MS, like "Checker Application, PowerApps" and "Support User"?

I still would like to see if there is a way to identify a User record as licensed or not through Advanced Find...

Thanks,



------------------------------
Jim Corriveau
A.W. Chesterton Company
Groveland MA

Original Message:
Sent: Nov 14, 2019 10:33 AM
From: Edrei Mpanduki
Subject: O365 Users Appearing in D365 with Insights User Security Role

Patrick,
We had the same issue in our environment but this was with Microsoft Project. We solved it it by creating  an AD Security Group and adding users only individuals with a D365 license as members and then applying that security group to the Dynamics 365 instance. That should remove any users form the environment that are not members of security group regardless what type of license they're assigned.

We also use this same process to restrict our Dev and QA environments to certain users.

Here's a blog post about creating and assigning security groups to Dynamics 365 instances

https://community.dynamics.com/365/b/d365demystified/posts/restrict-user-access-to-a-d365-instance-using-security-groups

------------------------------
Edrei Mpanduki
CRM Technical Analyst
Scottsdale AZ

Original Message:
Sent: Apr 11, 2018 02:29 PM
From: Patrick Wright, MCSE
Subject: O365 Users Appearing in D365 with Insights User Security Role

I've confirmed with an O365 Global Admin that none of these new users had been granted D365 licenses or O365 global admin rights. However, they appear in my Enabled Users view preset with the Insights User security role selected.

I've taken the step of removing this security role from each user, but I would like to stop the automated process in the future.

Anyone else experience this situation?

------------------------------
Patrick Wright, MCSA
Central Virginia CRMUG Chapter Leader
www.crmug.com/richmond

Marketing Technology Lead
Cherry Bekaert LLP
Richmond VA
pwright@cbh.com
------------------------------