3.3 Teams Architecture: Owner, Access, and Microsoft Entra (AAD) Group Teams
Key Takeaways
- Dataverse supports four primary team modalities: Traditional Owner Teams, Manual Access Teams, Template-Driven Access Teams, and Microsoft Entra (Azure AD) Group Teams.
- Owner Teams can own records and have security roles assigned directly to them, with all members inheriting the team's security roles and ownership scope.
- Access Teams cannot own records and cannot have security roles assigned; they provide lightweight, dynamic record sharing for ad-hoc cross-functional collaboration via Access Team Templates.
- Microsoft Entra Group Teams automatically synchronize membership from Microsoft Entra ID Security Groups or Microsoft 365 Groups, eliminating manual user provisioning and offboarding overhead in Dataverse.
- Entra ID Group Teams support two inheritance models: 'Direct User (Basic) access and Group privileges' vs 'Group privileges only', governing whether members can independently execute actions requiring User/Basic depth on personal records.
3.3 Teams Architecture: Owner, Access, and Microsoft Entra (AAD) Group Teams
In modern enterprise deployments, assigning security roles to individual users creates significant administrative friction, compliance risks, and governance overhead. Microsoft Dataverse provides a powerful Teams Architecture that streamlines access management, supports cross-functional project collaboration, and integrates natively with corporate directory services.
Understanding the architectural distinctions between Owner Teams, Access Teams, and Microsoft Entra (formerly Azure Active Directory) Group Teams is a cornerstone of the PL-200 certification.
1. Architectural Taxonomy of Dataverse Teams
Dataverse provides four distinct team implementations, each tailored to specific operational requirements, data ownership patterns, and performance considerations.
+-----------------------------------------------------------------------------------+
| DATAVERSE TEAMS TAXONOMY |
| |
| +---------------------------------------------------------------------------+ |
| | 1. OWNER TEAMS | |
| | - Can own records (`ownerid` = Team GUID) | |
| | - Can have Security Roles directly assigned | |
| | - Membership managed manually in Dataverse | |
| +---------------------------------------------------------------------------+ |
| | 2. ACCESS TEAMS (Template-Driven) | |
| | - CANNOT own records (No record ownership) | |
| | - CANNOT have Security Roles assigned | |
| | - Dynamically shares records via Access Team Templates & Sub-grids | |
| +---------------------------------------------------------------------------+ |
| | 3. MICROSOFT ENTRA (AAD) SECURITY GROUP TEAMS | |
| | - Auto-synced membership from Entra ID Security Groups | |
| | - Can own records AND have Security Roles assigned | |
| | - Enterprise identity lifecycle integration (Automated JIT access) | |
| +---------------------------------------------------------------------------+ |
| | 4. MICROSOFT ENTRA (AAD) OFFICE 365 GROUP TEAMS | |
| | - Auto-synced membership from Microsoft 365 Groups / Teams Channels | |
| | - Supports modern collaborative M365 workspaces | |
| +---------------------------------------------------------------------------+ |
+-----------------------------------------------------------------------------------+
2. Owner Teams: Shared Ownership & Role Aggregation
An Owner Team is a traditional Dataverse team designed to hold shared ownership of data records and propagate security roles to its members.
Core Characteristics
- Record Ownership: An Owner Team can be set as the owner of any User/Team-owned record. When a record is assigned to an Owner Team, the record's
owneridfield stores the Team's GUID, and theowningbusinessunitmatches the Team's Business Unit. - Security Role Assignment: Administrators can assign one or more security roles directly to the Owner Team. Every member of the team inherits all privileges granted by those security roles.
- Business Unit Membership: In classic mode, all members of an Owner Team had to belong to the same Business Unit as the team. In modern BU matrix security, users from any Business Unit can be added to an Owner Team.
- Use Cases: Ideal for departmental queues (e.g., "Tier 1 Support Queue Team"), regional shared accounts ("Mid-Atlantic Account Team"), and functional processing pools where work items are picked up by any available team member.
3. Access Teams: Lightweight Collaboration & Template-Driven Sharing
When cross-functional groups of users need temporary, ad-hoc access to specific records without changing record ownership or assigning broad security roles, traditional Owner Teams cause administrative bloat. Access Teams solve this challenge.
+-----------------------------------------------------------------------------------+
| ACCESS TEAM TEMPLATE CONFIGURATION FLOW |
| |
| [Step 1: Enable Table] |
| - Set Table Property: 'Access Teams' = Enabled |
| | |
| v |
| [Step 2: Create Template] |
| - Navigate to Settings -> Access Team Templates |
| - Target Entity: Opportunity |
| - Access Rights Selected: [X] Read [X] Write [ ] Delete [X] Append |
| | |
| v |
| [Step 3: Embed Sub-grid on Form] |
| - Add Sub-grid to Opportunity Main Form |
| - Entity: Users |
| - Selected Access Team Template: 'Deal Collaboration Template' |
| | |
| v |
| [RUNTIME USER EXPERIENCE] |
| - Opportunity Owner adds 'Alice' to the form sub-grid. |
| - Dataverse automatically instantiates a lightweight access team and shares |
| the record with Alice granting Read, Write, and Append permissions! |
+-----------------------------------------------------------------------------------+
Access Team Mechanics
- Zero Record Ownership: Access Teams cannot own records. The record owner remains the original user or owner team.
- Zero Security Roles: You cannot assign security roles to an Access Team. The team exists purely as a dynamic sharing mechanism.
- Access Team Templates: A template defines the precise set of permissions granted to team members on records of a specific table. Supported access rights include: Read, Write, Append, Append To, Delete, Assign, and Share.
- Sub-grid Automation: When an administrator adds a User sub-grid configured with an Access Team Template to a model-driven form, end users can add or remove colleagues directly on the record. Adding a user automatically creates a system-managed access team behind the scenes and shares the record with the specified rights; removing the user instantly revokes access.
- Performance Advantage: Unlike static record sharing, template-driven Access Teams are optimized by Dataverse to minimize performance overhead on the
PrincipalObjectAccess(POA) table.
4. Microsoft Entra (AAD) Group Teams: Automated Enterprise Governance
In enterprise IT environments, user provisioning and deprovisioning are centralized in Microsoft Entra ID (formerly Azure Active Directory). Managing Dataverse team memberships manually creates compliance drift and audit failures. Microsoft Entra Group Teams automate this lifecycle entirely.
+-----------------------------------------------------------------------------------+
| MICROSOFT ENTRA (AAD) GROUP TEAM SYNCHRONIZATION |
| |
| +----------------------------------+ |
| | MICROSOFT ENTRA ID (AAD) | |
| | Security Group: 'SG-Finance-App'| |
| | Members: Alice, Bob, Carlos | |
| +----------------------------------+ |
| | |
| | (Automatic Just-in-Time & Background Sync) |
| v |
| +----------------------------------+ |
| | DATAVERSE ENVIRONMENT | |
| | Entra ID Group Team: 'Finance' | |
| | Azure AD Object ID: <GUID> | |
| | Security Role: Finance Analyst | |
| +----------------------------------+ |
| | |
| +-----------------+-----------------+ |
| | | |
| v v |
| When Alice logs in, Dataverse When Carlos is removed from Entra ID, |
| instantly grants 'Finance Analyst' Dataverse automatically revokes his |
| permissions via Group Team! permissions upon next token refresh! |
+-----------------------------------------------------------------------------------+
Entra Group Team Types
- Entra Security Group Teams: Bound to an Entra ID Security Group. Ideal for role-based IT access governance.
- Office 365 Group Teams: Bound to a Microsoft 365 Group (such as a Microsoft Teams channel). Ideal for collaborative business projects and shared departmental workspaces.
Configuration Parameters
- AAD Object ID: The unique Object ID GUID of the group in Microsoft Entra ID.
- Business Unit: The Business Unit in Dataverse to which the group team is assigned.
- Membership Type: Controls who is synchronized into the team: Members and Guests, Members only, Owners, or Guests only.
Group Privilege Inheritance Options
When configuring an Entra Group Team, administrators select the Membership Privilege Inheritance model:
| Inheritance Option | Operational Mechanics | When to Use |
|---|---|---|
| Direct User (Basic) access and Group privileges | Members inherit both group privileges AND direct User (Basic) depth privileges. Users can create, modify, and own personal records using the role's privileges. | Standard business roles where users perform daily transactional work (e.g., Sales Reps, Support Agents). |
| Group privileges only | Members do NOT inherit User (Basic) depth privileges for personal execution. Users can only act within the context of the team on records owned by the team or business unit. | Specialized, restricted roles such as System Auditors, Approvers, or Shared Service Processors who should not create personal records. |
5. Architectural Decision Matrix: Choosing the Right Team Type
| Criteria | Owner Team | Access Team (Template) | Entra Security Group Team |
|---|---|---|---|
| Can Own Records? | Yes | No | Yes |
| Can Have Security Roles? | Yes | No | Yes |
| Membership Source | Manual in Dataverse | Dynamic via Form Sub-grid | Automated via Entra ID |
| Dynamic Ad-Hoc Sharing | Poor | Excellent (Optimized) | Poor |
| Identity Governance Cost | High (Manual maintenance) | Low (Self-service per record) | Minimal (Automated via Azure AD) |
| Recommended Use Case | Departmental record queues | Deal/Case collaborative teams | Enterprise role assignment |
A consulting firm requires a security model where project managers can dynamically grant team members temporary Read and Write access to specific project proposal records. The list of collaborators varies for every proposal, collaborators must not be granted broad access to other proposals, and proposals must remain owned exclusively by the project lead. Which Dataverse team feature should be implemented?
An enterprise organization with 5,000 employees wants to automate Dataverse access assignment so that when an employee is added to the corporate 'Claims Processors' Active Directory group, they automatically receive the 'Claims Adjuster' security role in Dataverse without manual IT intervention. Which team architecture must be configured?
An administrator is configuring a Microsoft Entra Group Team for external compliance auditors who must review records owned by the auditing team, but must be strictly prohibited from creating or owning personal records in Dataverse. Which Membership Privilege Inheritance setting must be selected?
Which of the following statements correctly distinguishes an Owner Team from an Access Team in Microsoft Dataverse?