Unified Dynamics 365 system administrator management in PPAC

Microsoft keeps bringing experiences across different Dynamics 365 applications and the Power Platform together. A new preview feature is available where you can manage system administrator users for Dynamics 365 and the Power Platform in a single place. This blog describes the details and impact of enabling the preview via Feature management.

Unified admin user management

A few months back, I participated in a private preview for this feature. It is exciting to see how Microsoft is still converging the different platforms they use today for their business applications. Now all feedback has been incorporated, the feature is already available for several weeks.

Before you enable the feature, you should realize the impact. When having the feature enabled, Power Platform Admin Center (PPAC) will be the only place where you can add the system administrator role to users. When you enable the feature, it will reassign the system administrator role as per user settings in PPAC. Any user having the system administration role in Dynamics 365 F&O will be revoked from this role in case they don’t have it assigned in PPAC.

The feature is visible in several environment versions, but might be locked due to prerequisites. Before enabling the feature, use the following checklist if you can enable it.

1. Dynamics 365 F&O 10.0.48, having platform update 72 (PU72) version 7.0.7996.61 or higher
2. Unified User Management Solution version 9.3.3445.2 or higher
3. The user enabling the feature should be a system administrator in both Dynamics 365 F&O and the PPAC environment
4. Manually update system administrators in PPAC to prevent losing permissions in Dynamics 365

The Unified User Management Solution can be checked by navigating to Environment > Resources > Dynamics 365 apps on PPAC. If there is an update available for this solution, it is recommended to update it. For an automation on updating Dynamics 365 apps in your tenant, you can check out a solution shared by Laze Janev: Spend 5 minutes once. Save hours every week: tenant-wide Dynamics 365 app updates on autopilot | LinkedIn

After this checklist, you can enable the feature. In this blog, I have some scenarios to demonstrate the impact when enabling the unified admin user management feature.

Walkthrough

Before enabling the feature, there are existing users in Dynamics 365 F&O. One of the users is ErinH. For this demo, I have granted the System Administrator role.

To keep the example simple, I now have only two system administrator users in this environment. Anyway, it is recommended to have a short list of system administrators as each of these users will be a risk as they have unrestricted access to sensitive data and all application features.

In Power Platform Admin Center, ErinH does not have any security roles assigned.

Another user, Fernando, is created as a system administrator in PPAC, but he is not activated as a user in Dynamics 365 F&O.

My user is a system administrator in Dynamics 365 F&O, and the environment on PPAC. Now we can go to Feature Management and search for the feature with the name (Preview) Unified admin user management. When the feature becomes generally available, the preview prefix will be removed from the feature name.

In case you do not meet the minimum version requirement, the Status will have a red cross icon. In the details you can then read: “You cannot enable this feature. Available exclusively in UNO environments with required product configurations in place.“

Currently, in my environment, the Learn more link isn’t taking you to the correct page on Microsoft Learn. You can find the documentation here: Admin user management unification for Finance and Operations in Power Platform admin center (preview) – Power Platform | Microsoft Learn

Click on Enable now.

As this is a preview feature, you should agree to the preview terms, and enabling the feature is not supported in production environments. By enabling the feature, it will directly synchronize system administrators from PPAC, where PPAC will be the new source of truth for system administration users in your environment.

The user ErinH is not a system administrator in Dynamics 365 F&O anymore. The synchronization process will create the user if the user doesn’t exist. It will also assign the system administration role. When you add more system administration users in PPAC, the will be directly synced as system administrator in F&O as well.

Assigning or revoking roles from F&O is locked for the system administrator role. You can notice the disabled actions on the screenshot above, but also when assigning roles to the user, the system administrator role is hidden.

In addition, you can’t delete a user with the system administrator role, as you first need to revoke the role from PPAC. If you try to delete an admin user from F&O, you will get the next error: “Admin user cannot be deleted. Please contact your System Administrator for further assistance.“

Make environment admin

With this unified admin user management feature, you will also get an option to change the main administrator of the Dynamics 365 F&O environment. It happens quite a lot that a Dynamics 365 F&O environment was created with a normal user account, instead of a specific administrator account. There might be a difference between the owner of the Power Platform environment and the F&O instance. For the purpose of changing the ownership, you can use a new action from the User management details page.

For example, my user is the current Admin user, and there is another Microsoft Dynamics 365 admin user in the tenant. You can make this user the new Admin, and my user will be recreated with the user ID Andre.

Click on the user ID of the user that you would like to make the new environment Admin. The user needs to be assigned to the System administrator role before you can change the environment administrator.

Click on the action Make environment admin. Be aware that there is no additional confirmation required. It will directly switch the users. When you close the details and refresh the data, you will notice that MSDyn365Admin is now linked to the Admin user and a new user is created for the old Admin user.

The action is only changing the Admin user in Dynamics 365 F&O. It will not have an impact on the owner of a Dataverse environment.

There is more…

The Unified admin user management feature comes with some advantages, but also some caveats.

First, an external guest user can be configured as a system administrator, but an external user can’t open your Power Platform Admin Center without being enabled with Granular Delegated Admin Privileges (GDAP). It will give your organization control which users will be assigned the system administrator role. A person from a partner can’t do it without additional privileges. In case the external user will be provided with an account in your tenant, it will be possible to directly manage the Power Platform environment.

If you add people as system administrator on PPAC, they will also get access to other deployed Dynamics 365 apps. E.g., they will not only be able to manage F&O, but also have the privileges to manage e.g. Dynamics 365 Sales, or Field Service.

Before assigning any user as a system administrator, regardless if it is in Dynamics 365 F&O or via PPAC, perform a risk assessment. In case you don’t want to have the user an overall system administrator, consider assigning distinct security roles.

I do hope you liked this post and will add value for you in your daily work as a professional. If you have related questions or feedback, don’t hesitate to use the Comment feature below.


That’s all for now. Till next time!