Customer Engagement & Dynamics CRM Forum

Expand all | Collapse all

O365 Users Appearing in D365 with Insights User Security Role

  • 1.  O365 Users Appearing in D365 with Insights User Security Role

    D365UG/CRMUG ALL STAR
    Posted Apr 11, 2018 02:30 PM
    I've confirmed with an O365 Global Admin that none of these new users had been granted D365 licenses or O365 global admin rights. However, they appear in my Enabled Users view preset with the Insights User security role selected.

    I've taken the step of removing this security role from each user, but I would like to stop the automated process in the future.

    Anyone else experience this situation?

    ------------------------------
    Patrick Wright, MCSA
    Central Virginia CRMUG Chapter Leader
    www.crmug.com/richmond

    Marketing Technology Lead
    Cherry Bekaert LLP
    Richmond VA
    pwright@cbh.com
    ------------------------------
    The first step toward cloud success. - Migrate from CRM to D365 with expert guidance from Microsoft. I'm Ready


  • 2.  RE: O365 Users Appearing in D365 with Insights User Security Role

    TOP CONTRIBUTOR
    Posted Apr 17, 2018 10:09 AM
    Have you recently installed Insights?

    Microsoft Insights | Targeting Business Intelligence for Microsoft Dynamics Workflow | InsideView


    The security role appears to be for this solution, it's not an out of the box one. The installation guide states that it adds the role to all users  on setup, but I'm not sure if it continues to add it for new users when already installed.

    I wouldn't think this solution can assign licences, or otherwise activate users who don't have a licence. Are you saying that these users are showing up in Dynamics 365, even without a licence assigned? That should only happen if they are an Office 365 admin (as you've stated), or if they've been set up with the access mode of "non-interactive".



    ------------------------------
    Tom Pickles
    CRM Support Analyst
    Chess Digital
    Edinburgh SC
    ------------------------------

    The first step toward cloud success. - Migrate from CRM to D365 with expert guidance from Microsoft. I'm Ready


  • 3.  RE: O365 Users Appearing in D365 with Insights User Security Role

    TOP CONTRIBUTOR
    Posted Apr 17, 2018 10:09 AM
    Hi Patrick,

    I'm not sure if this is the same thing or not, but I opened up a case with Microsoft last week about a similar issue. I found that around 124 users showed up as enabled in Dynamics, even though they didn't have licenses assigned. 

    The Microsoft rep said the following...

    "The reason the users synced into CRM relates to new features that we are implementing which integrates some of our applications with CRM. An example of this can be read here: https://blogs.msdn.microsoft.com/crm/2018/03/21/whats-new-in-the-dynamics-365-admin-center/ In order to disable the users from being synced into CRM you will need to disable the PowerApps/Flow/Common Data Services Viral Licenses in O365."

    I found that removing the "Microsoft Flow Free" license from the user also removed them as an active user in Dynamics, confirming what the rep said.

    I'm glad I found out why the users suddenly showed up, but feel Microsoft messaging could have been much better on the subject. That blog post doesn't mention a thing about users suddenly showing up as enabled in Dynamics.

    ------------------------------
    Steve Platz
    Commercial Excellence Technical Lead
    LORD Corporation
    Cary NC
    ------------------------------

    The first step toward cloud success. - Migrate from CRM to D365 with expert guidance from Microsoft. I'm Ready


  • 4.  RE: O365 Users Appearing in D365 with Insights User Security Role

    D365UG/CRMUG ALL STAR
    Posted Apr 17, 2018 10:09 AM
    Edited by Marghet Hager Apr 17, 2018 10:17 AM
    ​Good morning @Patrick Wright @Patrick Wright, MCSA!
    We had the same thing happen on ​4/7 around noon. There was an insights patch installed in our environment at that time.
    The common thread we found was that all of the users who appears in Dynamics 365 (even though they were not assigned a CRM license) had a MS Flow license.  We have a ticket open with MSFT about this, but have not heard back yet.

    I will let you know what we find out!

    Laura

    ------------------------------
    Laura Mortick
    Marketing Information Systems Manager
    Terracon
    Olathe KS
    ------------------------------

    The first step toward cloud success. - Migrate from CRM to D365 with expert guidance from Microsoft. I'm Ready


  • 5.  RE: O365 Users Appearing in D365 with Insights User Security Role

    Posted Apr 17, 2018 10:12 AM
    ​This occurs in my system as well. It was a problem for us because the Insights role granted access to parts of Dynamics that I didn't want my some of my staff to access - specifically, the Insights role grants access to Business Process Flows.

    Per Microsoft and InsideView when I talked with them mid 2017 there was no way to stop this. I worked with my developers to get a plugin that automatically removes the Insights role and assigns our custom roles.

    ------------------------------
    Sarah Schneider
    ECG Management Consultants
    Seattle WA
    ------------------------------

    The first step toward cloud success. - Migrate from CRM to D365 with expert guidance from Microsoft. I'm Ready


  • 6.  RE: O365 Users Appearing in D365 with Insights User Security Role

    Posted Apr 17, 2018 10:14 AM
    Hi Patrick,
    We saw something similar this week - a free flow licence was granted to some users in Office 365, which caused them to appear in our CRM list of active users. We have confirmed that removing the flow licence causes them to disappear.
    In our case they appeared with no security roles assigned.

    We would like to remove these extras as it causes confusion for our other users to see them in the list in CRM.

    ------------------------------
    Jo Anslow
    Information Systems Specialist
    Granta Design
    Cambridge
    ------------------------------

    The first step toward cloud success. - Migrate from CRM to D365 with expert guidance from Microsoft. I'm Ready


  • 7.  RE: O365 Users Appearing in D365 with Insights User Security Role

    TOP CONTRIBUTOR
    Posted Apr 17, 2018 10:15 AM
    ​I've actually seen this as well but I haven't really taken the time to investigate yet.

    ------------------------------
    Jill Vazquez
    Technical Specialist - CRM
    Bioventus, LLC
    Durham NC
    ------------------------------

    The first step toward cloud success. - Migrate from CRM to D365 with expert guidance from Microsoft. I'm Ready


  • 8.  RE: O365 Users Appearing in D365 with Insights User Security Role

    TOP CONTRIBUTOR
    Posted Apr 17, 2018 10:15 AM
    Hi, Patrick,

    After seeing your post, I did a quick security review.  Found where the O365 team had created a couple of global admins, so had to remove both the Insights role as well as the Systems Administration role.  However, the service accounts that never had a global admin role did not show up at all on the D365 side.

    (Side note: we're on D365 sales and customer service along with O365.)

    Is it possible the users you're seeing were accidentally set as global admins and then the role was removed?  Would that leave a ghost ID behind in D365?

    Cheers,
    Phyllis

    ------------------------------
    Phyllis Eriksen
    Manager - Projects and Product Services
    Audimation Services, Inc.
    Houston TX
    ------------------------------

    The first step toward cloud success. - Migrate from CRM to D365 with expert guidance from Microsoft. I'm Ready


  • 9.  RE: O365 Users Appearing in D365 with Insights User Security Role

    TOP CONTRIBUTOR
    Posted Nov 14, 2019 09:39 AM
    All,

    I understand that MS will grant access to CDS/CRM data at will.  What I want to know, is there a way from within CRM for me to create an Advanced Find that will show me only Users that are assigned a Dynamics 365 CE or Dynamics 365 Team license?  And the opposite as well, all Users that are not assigned a Dynamics 365 license?

    Thanks in advance,

    ------------------------------
    Jim Corriveau
    A.W. Chesterton Company
    Groveland MA
    ------------------------------

    The first step toward cloud success. - Migrate from CRM to D365 with expert guidance from Microsoft. I'm Ready


  • 10.  RE: O365 Users Appearing in D365 with Insights User Security Role

    GOLD CONTRIBUTOR
    Posted Nov 14, 2019 10:33 AM
    Patrick,
    We had the same issue in our environment but this was with Microsoft Project. We solved it it by creating  an AD Security Group and adding users only individuals with a D365 license as members and then applying that security group to the Dynamics 365 instance. That should remove any users form the environment that are not members of security group regardless what type of license they're assigned.

    We also use this same process to restrict our Dev and QA environments to certain users.

    Here's a blog post about creating and assigning security groups to Dynamics 365 instances

    https://community.dynamics.com/365/b/d365demystified/posts/restrict-user-access-to-a-d365-instance-using-security-groups

    ------------------------------
    Edrei Mpanduki
    CRM Technical Analyst
    Scottsdale AZ
    ------------------------------

    The first step toward cloud success. - Migrate from CRM to D365 with expert guidance from Microsoft. I'm Ready


  • 11.  RE: O365 Users Appearing in D365 with Insights User Security Role

    TOP CONTRIBUTOR
    Posted Nov 15, 2019 10:04 AM
    Edrei,

    Thanks for this, i understand that if i created the AD groups and assigned the group to the environment only the Users in the group would appear in the environment.

    Does this include User Accounts pushed by MS, like "Checker Application, PowerApps" and "Support User"?

    I still would like to see if there is a way to identify a User record as licensed or not through Advanced Find...

    Thanks,



    ------------------------------
    Jim Corriveau
    A.W. Chesterton Company
    Groveland MA
    ------------------------------

    The first step toward cloud success. - Migrate from CRM to D365 with expert guidance from Microsoft. I'm Ready


  • 12.  RE: O365 Users Appearing in D365 with Insights User Security Role

    GOLD CONTRIBUTOR
    Posted Nov 15, 2019 11:03 AM
    Jim, user accounts like  Checker Application, Microsoft Flow are Application users and they're not affected by security groups they'll still be in the instance without adding them to the security group.
    As for a way to identify whether a user is assigned a license or what type of license us assigned using an Advanced find, I don't think that is possible.

    However I have an idea that I haven't had a chance to test out, you could create a custom entity in Dynamics and pull that information in using Flow/Automate. There's a Get User Profile(V2) action and once of the properties you can specify is assignedLicenses, you could try that and see if it solves your problem.

    Here's the documentation on the Get User Profile Action
    https://docs.microsoft.com/en-us/connectors/office365users/#get-user-profile-(v2)


    ------------------------------
    Edrei Mpanduki
    Technical Analyst
    Scottsdale AZ
    ------------------------------

    The first step toward cloud success. - Migrate from CRM to D365 with expert guidance from Microsoft. I'm Ready


If you've found this thread useful, dive deeper into User Group community content by role