Automated Member Sync from Entra Security Groups to Dataverse Teams

When you link a Microsoft Entra security group to a Dataverse team, members must have signed into the Power Platform environment at least once before they appear in the team roster. This can delay access to apps, flows, and other resources for new hires who are added to the group but have never visited the environment. The solution is an automated flow that force‑syncs the user’s account to the environment and then immediately synchronises the team membership. This article walks through a complete, reusable implementation.

Understanding the Sync Gap

By default, a Dataverse team that is created with the type “Microsoft Entra ID Security Group” will only reflect members whose accounts already exist in the environment’s Users table. The platform does not proactively provision a user when they are added to the linked security group — that action alone does not create a user entry in Dataverse. This gap means the team remains empty for any new member until they personally log in, which is often impractical for automated onboarding scenarios.

The fix is a two‑step Power Automate flow:

Force‑sync the user into the environment (creates the user record).
Trigger the built‑in Dataverse bound action SyncGroupMembersToTeam to refresh the team membership.

Scenario: Contoso's Product Development Team

At Contoso, the Product Development department controls access to its model‑driven app and several supporting Power Automate flows through an Entra security group named PD-App-Access. The team lead adds new developers to this group expecting them to gain immediate access. Without automation, each new developer must either receive a special invitation link or manually browse to the environment at least once — an extra step that slows down onboarding.

The flow described below eliminates that manual intervention. When a user is added to PD-App-Access, the flow runs, creates the user record in the environment, and refreshes the linked Dataverse team (called Product Development Team) so the user appears instantly.

Prerequisites

Before building the flow, ensure you have:

A Power Platform environment with Dataverse enabled.
System Administrator or equivalent permissions in that environment.
Permission to create and edit Power Automate flows.
Access to the Azure portal to manage Entra groups and add members.

Step 1: Prepare the Entra Security Group

Go to the Azure portal and navigate to Microsoft Entra ID > Groups.
Select the group you will link to your Dataverse team (e.g., PD-App-Access). If it does not exist, create a new Security group.
Optionally, add one test member who is not already a user in your Power Platform environment. This person will be used later to validate the flow.

Step 2: Create a Linked Dataverse Team

Sign in to the Power Platform admin center.
Go to Environments, choose your environment, and select Teams under the Access section.
Click Create team.
Set the Team name (e.g., Product Development Team).
For Owner, choose yourself or another administrator.
For Team type, select Microsoft Entra ID Security Group.
Pick the security group you prepared in Step 1 (e.g., PD-App-Access).
Assign appropriate security roles (e.g., “Basic User” plus any custom roles needed by the team).
Save the team.

Now inspect the team’s Members tab. The test member you added earlier is not shown yet — that is the sync gap we are about to solve.

Step 3: Build the Automation Flow

Open Power Automate and create a new instant cloud flow. You can later convert it to an automated flow that triggers on group changes — we will use the Office 365 Groups connector, which works for Entra security groups as well.

Choose the Trigger

Select the trigger When a group member is added or removed (Office 365 Groups connector). Configure it with your security group (PD-App-Access).

Add a Condition

The trigger fires for both additions and removals. We only want to proceed when a member is added.

Insert a Condition action. Use the following expression in the condition toolbox (advanced mode):

powerfxCondition expression for addition

@equals(triggerOutputs()?['body/removed'], false)

Place it in the If no branch of the condition (the removal path can be left empty or used for a different notification).

Force Sync the User

Inside the If no branch (i.e., user was added), add a Power Platform for Admins action named Force Sync User:

Environment: select your Power Platform environment.
ObjectId: use the User Id dynamic value from the trigger (triggerOutputs()?['body/userId']).

This action creates the user record in the environment’s Users table.

Sync Group Members to the Dataverse Team

Immediately after the force sync, add a Dataverse action called Perform a Bound Action:

Table name: Teams
Bound action: SyncGroupMembersToTeam
Row ID: the unique identifier (GUID) of your Dataverse team.

Retrieving the Team ID

In the Power Platform admin center, open the Teams page for your environment.
Select the team you created in Step 2.
Look at the URL in your browser. The id query parameter contains the team GUID. For example:
```
...&id=ff3a1b2c-99d8-4e12-9abc-1234567890ab...
```
Copy that GUID.

Paste the GUID into the Row ID field of the bound action.

The complete flow now looks like this:

Flow overview

Trigger (When a group member is added or removed) → Condition (if not removed) → Force Sync User → Perform Bound Action (SyncGroupMembersToTeam)

Step 4: Test the Process

Turn on the flow.
In the Azure portal, add a new member to the security group PD-App-Access.
Within a minute, the flow should trigger. Monitor the Run history to confirm both actions succeeded.
Return to the Power Platform admin center, open the Product Development Team, and check the Members tab. The new user now appears.

Security and Performance Considerations

Permissions: The flow uses Power Platform for Admins, which requires the flow owner to have Power Platform administrator privileges (or equivalent). For production, consider using a dedicated service account with the minimal required roles (e.g., System Administrator in the environment if the Flow uses a connection acting on behalf of the owner).
Throttling: The Force Sync User action and the bound action are not designed for bulk operations. If you regularly add dozens of members at once, the flow may be throttled. In such cases, consider staggering additions or using a batch sync (outside the scope of this article).
Delegation: The trigger from the Office 365 Groups connector automatically listens to both Office 365 and Entra security groups. No additional configuration is required.

Common Issues and How to Avoid Them

Issue	Cause	Resolution
Flow does not trigger when a member is added to the security group.	The group might be a mail-enabled security group or the connector is not authorised for the group’s tenant.	Ensure the group is a pure Security group and that the flow owner has Groups.Read.All and GroupMember.ReadWrite.All (or sufficient admin consent).
Force Sync User fails with a “User already exists” error.	The user was previously added (manually or by an earlier sync).	The action is idempotent; the error can be safely ignored, or you can wrap it in a Configure run after to still proceed.
Bound action fails: “Team not found”.	The Row ID is incorrect or the team was recreated.	Always copy the GUID from the URL immediately after saving the team. If you recreate the team, you must update the flow with the new ID.
Bound action is not visible in the list of actions.	The Teams table is not available because the entity was never selected in the Dataverse catalog.	Run a List Rows action on the Teams table first to force the connector to discover the entity.

Conclusion and Next Steps

By combining the Force Sync User and SyncGroupMembersToTeam actions, you can completely automate the provisioning of new team members from an Entra security group to a Dataverse team. This removes the prerequisite that each user must log in once, speeding up onboarding and centralising access management.

You can extend this pattern by:

Adding a parallel branch that activates a user in other downstream systems.
Sending a welcome email once the team membership is confirmed.
Using the same trigger to remove members from the team when they are removed from the security group (the SyncGroupMembersToTeam action handles that automatically — it mirrors the group’s membership).

References

Original article by Matthew Devaney: Force Sync Users From Entra Security Group To Dataverse Team
Microsoft Learn: SyncGroupMembersToTeam action reference
Microsoft Learn: Manage Dataverse teams