In Entra admin, how to assign users to different apps with one user flow/group

(1) Share

Report

Posted on by SD-06011338-0

Hi There,

can someone please help me understanding below scenario

I have different PowerPage applications. In Entra Admin center I will register multiple application but want to create only one user flow and one user group. Adding all the external users in that user group.

1st question:
Now how I can assign External users to access different application like

User 1, 2 and 3 should have access to Application 1

User 4,5 and 6 should have access to Application 2 etc..

2nd question:

I see there is only authenticated and Anonymous role for the pages and sub pages. Then as per my understanding if we have 3 authorized user then all 3 users have same access to all pages and sub pages ?

Regards,

Categories:

General

All responses (4)

Answers (0)

VD-20031046-0 10 on at

Like (0)

Report

In Entra admin, how to assign users to different apps with one user flow/group

Thanks a ton Fubar, it is much clearer now.

I do have one last query.

In Entra Admin , for registered Application , I have set it up Assignment as Required and done setup Self-Service. Screen shot as follows

After these settings when user is getting added in Entra then from where Admin will approve or authorize the users ?
Suggested answer

Fubar 7,930 Super User 2025 Season 1 on at

Like (0)

Report

In Entra admin, how to assign users to different apps with one user flow/group

The Table Permissions that you associate to each Web Role in combination with the types of forms you have defined determines readonly/edit etc (e.g. you can create a Basic Form that is readonly, and even if the web role has a table permission with edit privilege the user will not be able to edit using that form, but if you define an edit form and the table permission only has read access then the user will not be able to edit).

By default the Web Roles subgrid will not be automatically added to all Dataverse Forms, but does exist on the Portal Contact form which you can either add into your own App or use it in the Power Pages Management App. Also depending on what you are doing, if you are using the Invitations feature of the product you can also associate the Web Role to the Invitation and it will be automatically assigned when the user redeems the invitation.

If you have a defined group of users (a set of users), other than hard coding each user or some other identifying feature in the data you have about each user how do you expect to be able to say this user has access to app A and that user has access to App B. You need to have 2 groups (usually Security Groups) one for those needing access to A and another for those needing access to B.
SD-06011338-0 6 on at

Like (0)

Report

In Entra admin, how to assign users to different apps with one user flow/group

Thanks for the update Fubar... but I need some more help from you ,

I have created 2 web roles as follows and assign it to respective pages. But how we can add users to these roles and where we can define one role is for edit and other one is for view ??

primary role- able to edit data
secondary role - able to view data

And need a suggestion :

Regarding adding external users to Entra ..... there are no O365 groups, instruction is to add all external users manually in a single user group and then authenticate them to different applications (probably by using azure Conditional Access to only allow access). But I am thinking if it is the feasible way to do it or should we go with different user flow and user group to make life easy ??
Suggested answer

Fubar 7,930 Super User 2025 Season 1 on at

Like (0)

Report

In Entra admin, how to assign users to different apps with one user flow/group

You want to have an O365 Security Group for each set of users (same user could be in multiple groups), then on each Application (that is automatically created when you establish a Power Pages site) you would use azure Conditional Access to only allow access to each Application/Site to each respective Security Group.

Out of the box, there are 3 Web Roles, Administrator, Authenticated and Anonymous users. You can create different Web Roles with different sets of Table Permissions, and Web Page Access Control Rules. The one thing to understand is that the Web Role has a checkbox on it for Authenticated & Anonymous - in your set of Web Roles only 1 should ever have this checkbox checked for reach option (i.e. never 2 Web Roles with the Authenticated checked).

The checkbox indicates that a user who is authenticated will Inherit from that Web Role with the Authenticated checkbox, and a user who is not logged in will Inherit from the Anonymous one - if more than 1 Web Role has the checkbox checked then the system will choose 1 Web Role (i.e. the user only ever inherits from 1 Web Role even if there are 2 with Authenticated Checked).

To make use of multiple Web Roles you assign them to the user.

Back to your Azure part of the question, you can get away with 1 Security group, if you turn off the authenticated inheritance and only have the Web Roles assigned to the users - as it is the Web Roles that give permissions and if there is no inheritance the user will not be able to do anything - but they are technically logged in.