Environment Security Group Sync Validator

Overview

Weekly governance flow that reconciles Azure AD (Microsoft Entra ID) security group membership against Power Platform environment role assignments. Discrepancies are logged to a Dataverse audit table and delivered as a styled HTML report to the security team so stale access can be revoked and missing access provisioned on a regular cadence.

Use Case

Power Platform environments are commonly "gated" by an Azure AD security group whose members are expected to also hold an environment role (e.g., Environment Maker, System Customizer, System Administrator). Over time, two kinds of drift accumulate: users added to the group but never granted a role, and users who keep a role after being removed from the group. This flow detects both cases every Monday at 08:00 UTC, writes each discrepancy as a row in the flowlibs_securitysyncreports Dataverse table, and emails a consolidated report to the Security Admin. The report is only sent when discrepancies exist, so a clean week produces no noise.

The flow is ideal for teams that:

• IT admins enforcing Azure AD-based access governance on Power Platform environments
• Security teams that need a weekly reconciliation of group membership vs. environment role assignments
• Organizations auditing for both missing and stale environment access
• Tenants logging discrepancies to a Dataverse audit table for compliance review

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Target a different security group

Update flowlibs_SecurityGroupId with the new group GUID. No flow edit needed.

Validate a different environment

Update flowlibs_TargetEnvironmentName with the destination environment ID. The BAP admin API path is composed from this variable, so nothing else changes.

Change cadence

Edit the Recurrence_Weekly_Monday trigger (Weekly to Daily, or change weekDays/hours). The rest of the flow is cadence-agnostic.

Route the report elsewhere

Update flowlibs_SecurityAdminEmail. For multiple recipients, change to a semicolon-delimited list (Outlook SendEmailV2 accepts a@x.com;b@x.com).

Add additional role types

Replace the Filter_User_Principals expression equals(item()?['properties']?['principal']?['type'], 'User') with an or() that also matches 'Group' or 'ServicePrincipal' if you need to audit non-human access (also remove the email filter since service principals have no email).

Ignore known service accounts

Add a second condition inside each If_*_Not_In_* that rejects a hardcoded allow-list, e.g., and(not(contains(...)), not(contains(createArray('svc1@x.com','svc2@x.com'), email))).

Increase group size support

Entra GetGroupMembers is paged; if you expect more than 999 members, swap to an HTTP call to Graph /groups/{id}/transitiveMembers and iterate @odata.nextLink in a Do until loop.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@toLower(coalesce(item()?['mail'], item()?['userPrincipalName'], ''))

@toLower(coalesce(item()?['properties']?['principal']?['email'], ''))

@concat('https://api.bap.microsoft.com/providers/Microsoft.BusinessAppPlatform/scopes/admin/environments/', variables('varTargetEnvironment'), '/roleAssignments?api-version=2020-10-01')

@not(contains(variables('varEnvUserEmails'), outputs('Compose_Group_Member_Email')))

@greater(variables('varDiscrepancyCount'), 0)

@equals(item()?['properties']?['principal']?['type'], 'User')