[CoE Starter Kit - BUG] Admin | Sync Template v4 (Security Roles) Error on "List SystemUser Record"

[hanuschkaih]

Does this bug already exist in our backlog?

• I have checked and confirm this is a new bug.

Describe the issue

This error comes up for 2 users in 2 environments.
It seems to me as if disables users should be excluded in an earlier step of the flow.

Expected Behavior

No error

What solution are you experiencing the issue with?

Core

What solution version are you using?

4.29

What app or flow are you having the issue with?

Admin | Sync Template v4 (Security Roles)

What method are you using to get inventory and telemetry?

None

Steps To Reproduce

Activate Flow
Receive COE Error notification by email

Anything else?

No response

AB#3214

[Jenefer-Monroe]

Can you please check in Entra if these use cases are disabled there? I ask as Envts also have their own concept of enabled so wondering what your case is.

[hanuschkaih]

Hi Jenefer, thanks for your fast reply.

I did not find the users in Entra ID at all (tried to search in many ways, same result for both users)

[Jenefer-Monroe]

Thank you for checking that.
Can you please see if this fixes it for you?

Put this expression: isdisabled eq false and fullname eq '@{items('Apply_to_each_still_unknown')}'

Here:

Result you should see:
The flow should pass and these users should be entered as "Unknown" for UserType column.

[hanuschkaih]

Hi Jenefer,
I have changed the Filter but the result remains the same

By the way - another flow now fails with a quite similar message - maybe that helps...

[Jenefer-Monroe]

oh interesting. In that case we arent querying for users at all, I think it might be referencing the user identity running the flow. Which would correlate to the Forbidden message better.

Can you please :

1. Confirm that the user identity installing and running the flow has the Power Platform Admin Role assigned both directly and permanently?
   Microsoft Azure Users > Your User > Assigned Roles
   Ensure Power Platform Administrator is Direct and Permanent
   

2. Confirm that the user identity installing and running the flow has the System Administrator Security Role in the environment targetted here:
   

[hanuschkaih]

Hi Jenefer,

1. The user has the PP Admin role through Group Assignment - we don't use direct assignments and never had issues with it
   

2. The user does not have the System Administrator role in the target environment.
   We are aware of that and there are both organizational and technical reasons for this.

• Organizational: The environment is a dedicated environment for our subsidiary in Hungary and a security group is assigned to the environment where only dedicated Hungarian users may pe part of. The environemnt is managed by the Hungarian colleagues.
• Technical: The security group is managed in local Hungarian AD, then synced to Entra-ID, so the Power Platform Admin could not be selected to be part of the group
• A possible workaround would be to manually create an additional Entra ID group that holds both the PP Adnin and the original Security group - but that would both break organizational requirements and security standards as well as standardized technical processes.

[Jenefer-Monroe]

Unfortunately you need to have System Admin permission in the environment in order for our kit to be used to gather inventory.

In the past this requirement was not as obvious to people as the presence in the PPAdmin Role assigned the permission automatically. However this behavior is changing (feature in preview) and so that's why I asked as we will be adding tooling to add the PPAdmin to this role automatically going forward, once the connector is supported in all regions.

Please see #8119

[hanuschkaih]

OK, I see... so we need to finde a solution here...
In our case, it's not about the SysAdmin role, it's about the environment access at all, so the PIM workaround might not help...
When "security group" is enabled for an environemnt, is there another option to give the COE admin user access to the environment than adding the user to the security group?

This is the Entra ID group, and the Admin user is Cloud-Only, so it's not available in Windows Server AD

[Jenefer-Monroe]

Thanks for the suggestion. I did go test this after your note and found that the technique offered by the product team to escalate privaledge does work even if the user is not in the SG.
In my testing, it does not add them to the SG but does add them as a System Admin in the envt.

Please see the workaround solution file in #8119

[hanuschkaih]

Hi Jenefer, I tried out the workaround but the PIM Workaround flow also fails for this environment (and some others) for the same reasons that the user is not part of the security group...

[Jenefer-Monroe]

Are you running the flow as someone who is directly and permanently part of the Power Platform Admin Role?

[hanuschkaih]

No and yes - the role was assigned through a group, but it's permanent and without PIM. A Global admin has now changed it to a direct assignment with the following result * The PIM Flow still had 2 errors, but NOT for the respective environment * the Sync Template v4 (Security Role) Flow now ran succesfully when resubmitting the faulty runs Thanks for solving the issue! Best regards Ihno

[Jenefer-Monroe]

Hello can you please help me understand. So you had to set the PPAdmin to be direct, not through a group. And with that the issue with the SG went away?

[hanuschkaih]

Hi Jenefer,
exactly. We changed the CoE Admin user from group assignment (see screenhot above, May 13th 3:33pm) to direct assignement

After that, I ran the PIM Workaround flow again

it did not run into errors any more for the environment where the CoE Admin user is not member of the security group
After that, I ran the Admin | Sync Template v4 (Security Roles) flow again
it terminatesd successfully for the same environment

Best regards
Ihno

[Jenefer-Monroe]

Really appreciate your response. This is a new feature and so we are still working to understand the limitations it has.

[Jenefer-Monroe]

closing out as no further action for starter kit team