Dynamics 365 Finance Adds Entra Group Teams for Business Performance Planning Dimension Security

Previously, dimension security assignments inside Business performance planning were strictly limited to individual users. Under the updated web experience—listed as Launched for Worldwide (Standard Multi-Tenant) cloud instances—administrators can view and add eligible Microsoft Entra group-backed Dataverse teams right alongside individual user accounts, with separate membership information displayed for each assignment type.

For enterprise IT and finance operations teams, this update closes an awkward governance gap between identity management in Microsoft Entra ID and granular data-slice access in Business performance planning. However, because this capability bridges Entra groups, Dataverse group teams, and Business performance planning roles, getting it right requires understanding how each layer enforces permissions—and where legacy Dynamics 365 Finance security concepts do not apply.

What Changed in Business Performance Planning Dimension Security​

In Dynamics 365 Finance, Business performance planning relies on two distinct layers of access control, as documented on Microsoft Learn:

1. Role-based security, which governs what operations a person can perform in the planning app, Power BI planning visuals, and the Excel Add-in.
2. Dimension security, which controls which specific slices of planning data—such as scenarios, departments, accounts, or companies—a user is allowed to view or edit.

Dimension security is organized around dimension groups. An administrator (or any role carrying the Maintain security privilege) creates a dimension group, selects one or more dimensions, and defines whether members receive full access, read-only access, or row-level access to specific dimension values. Until this update, once a dimension group such as Executives or EMEA_Controllers was configured, every single analyst, controller, or manager had to be assigned to that dimension group individually.

Roadmap item 574117 changes the assignment target, not the underlying data-access model:

• Group-backed team assignments: Administrators can assign Dataverse group teams backed by Microsoft Entra groups to Business performance planning dimension security groups.
• Side-by-side administration: Eligible Entra group-backed teams appear alongside individual users during assignment, allowing hybrid setups where most staff inherit access via directory groups while exceptions are handled per user.
• Distinct membership visibility: The administrative interface separates membership information for individual user assignments versus Entra group-backed team assignments, helping auditors and admins tell how a given person gained access.
• Mandatory prerequisite: A Dataverse group team is not eligible out of the box simply because it exists in Entra ID; Microsoft specifies that the Dataverse group team must first be configured properly and assigned an appropriate Business performance planning security role.

Section Summary: Roadmap ID 574117 brings Entra group-backed Dataverse team assignments to Business performance planning dimension security groups in Worldwide multi-tenant environments, replacing user-only assignment bottlenecks while keeping existing dimension permission rules intact.

Don't Confuse This with Legacy Finance and Operations Entra Groups​

Before diving into setup, veteran Dynamics administrators should note an important architectural distinction. In core Dynamics 365 Finance and Operations (D365FO), there is an older feature inside System Administration called Microsoft Entra ID security groups. According to Microsoft Learn documentation for Finance and Operations core system administration, that older feature is considered a legacy capability—and starting with Financial reporting version 10.0.42, Financial reporting stopped supporting role and privilege assignments made through imported Entra ID security groups.

Business performance planning operates on a modern Microsoft Dataverse foundation. The new dimension security integration announced in roadmap item 574117 uses Dataverse group teams backed by Microsoft Entra groups, managed through the Power Platform admin center and the Business performance planning application. It has nothing to do with the legacy D365FO license configuration toggle.

How the Security Layers Fit Together​

Why does Microsoft emphasize that the Dataverse group team must first be configured and assigned an appropriate Business performance planning security role? Because in Dataverse and Business performance planning, dimension groups only filter data—they do not grant application access or operational capabilities.

1. Business Performance Planning Roles​

According to Microsoft Learn's security documentation for Business performance planning, users also need the App viewer role to access the application, alongside one of five out-of-the-box planning roles that dictate what actions they can take across the web app, Excel, and Power BI:

In the existing individual-user workflow documented on Microsoft Learn, the user assignment list for a dimension group is filtered so that it only shows users who have access to the msdyn_xpnadimension table. Assigning an appropriate Business performance planning security role to the Dataverse group team satisfies the application-level privilege requirement so the team can participate in planning security.

2. Dimension Group Access Rules​

Once a user or Entra-backed team is assigned to one or more dimension groups, Business performance planning evaluates data visibility using strict rules documented by Microsoft Learn:

• All values vs. Row-level access: A dimension group can grant Full access or Read-only access to all existing and future dimension values, or it can enforce Row-level access on selected existing values.
• Future value caveat: When using row-level access, newly created dimension values are not automatically included. By default, only the user who creates a new dimension value can see it unless a group grants access to all dimension values or an administrator explicitly grants read/write access to the new value.
• The Every-Dimension Cube Rule: For all Power BI and Excel visuals except the Table edit visual, a user must have access to at least one dimension value for every dimension in the cube to see data. If a cube contains four dimensions (Account, Company, Department, Scenario) and a group team is granted access to only three of them, members without another overlapping assignment will see blank visuals.
• Overlapping memberships: Users can belong to multiple dimension groups. When permissions overlap across groups, Business performance planning grants the highest permission level among all assigned groups.

Section Summary: Dimension security never works in isolation. A Dataverse group team needs a valid Business performance planning role to establish base table and app privileges, while dimension groups dictate row- and value-level visibility across cubes in Power BI and Excel.

Preparing Dataverse Group Teams for Dimension Security​

While Microsoft's existing Business performance planning documentation (last updated June 22, 2026) walks through clicking Dimension group list > select group > Users > Assign for individual accounts, the prerequisite work for Entra group-backed teams happens inside the Power Platform admin center.

Based on Microsoft Learn's Power Platform documentation for managing group teams, here is how administrators prepare an Entra group team and what operational behaviors to watch out for:

Step-by-Step: Creating and Role-Enabling the Dataverse Group Team​

1. Verify Entra ID Group Type: Ensure the target group exists in Microsoft Entra ID and you have its Object ID. Power Platform supports both Microsoft Entra Security groups and Microsoft 365 groups with Assigned or Dynamic User membership types (note that Dynamic Device membership is not supported in Dataverse group teams).
2. Open Power Platform Admin Center: Sign in with System Administrator (or equivalent) privileges, navigate to Manage > Environments, select your Dynamics 365 Finance / Dataverse environment, and go to Settings > Users + permissions > Teams.
3. Create the Group Team: Select + Create team and complete the required fields:
   • Team name: Must be unique within the business unit.
   • Business unit: Select the appropriate business unit.
   • Administrator: Choose an administrative user in the organization.
   • Team type: Choose either Microsoft Entra Security group or Microsoft Entra Office group.
   • Group name: Select the precreated Microsoft Entra group.
   • Membership type: Choose how Entra group roles map to the Dataverse team (Members and guests, Members, Owners, or Guests).
4. Assign the Business Performance Planning Security Role: Once the team is created, select the team checkbox in the Teams list, click Manage security roles, assign the appropriate Business performance planning role (such as Contributor, Limited Contributor, or Viewer, plus any required App viewer role), and click Save.
5. Assign to Dimension Groups in Business Performance Planning: With the Dataverse group team configured and role-enabled, administrators with the Maintain security privilege can now view and add the eligible Entra group-backed team alongside individual users inside Business performance planning dimension security groups.

Critical Operational Gotchas for Admins​

Synthesizing Microsoft's Dataverse group-team architecture with Business performance planning security reveals several real-world behaviors that can trip up helpdesks if they aren't anticipated:

• Immutability of Membership Type and Object ID: Once you create a Dataverse group team, neither the Microsoft Entra Object ID nor the Dataverse Membership type (e.g., Members vs. Members and guests) can be edited. Changing the membership type requires deleting the group team and recreating it—which in turn means redoing its role and dimension group assignments.
• Just-in-Time Member Rosters: In Dataverse, a group team's member list only displays users who have actually accessed the environment. If you add 50 financial analysts to an Entra security group on Monday morning, they will not all immediately appear in the Dataverse team roster until they sign in and access the environment.
• 8-Hour Cache Refresh Window: Dataverse derives group team privileges dynamically at runtime and caches a user's Microsoft Entra group memberships upon sign-in. According to Microsoft Learn, changes made to a user's Entra group membership won't take effect until the next time the user logs in or when the system refreshes its cache after 8 hours of continuous sign-in. If you revoke someone's sensitive budget scenario access by pulling them out of an Entra group mid-shift, keep that caching window in mind.
• Direct Query Requirement for Row-Level Access in Power BI: If your dimension group uses row-level access, remember that Power BI semantic model data source credentials must be configured with the checkbox Report viewers can only access this data source with their own Power BI identities using direct query.

Section Summary: Setting up Entra group-backed dimension security starts in the Power Platform admin center by linking an Entra Security or Microsoft 365 group to a Dataverse group team and assigning a Business performance planning security role. Administrators should account for Dataverse's runtime sign-in synchronization and eight-hour cache refresh cycle when testing access changes.

Why This Matters for Enterprise Finance Governance​

In medium and large enterprises, financial planning is rarely static. Cost-center managers rotate, regional FP&A pods spin up for merger integrations, and budget contributors shift between business units. When dimension security only accepted individual user assignments, finance administrators had to maintain a shadow directory inside Business performance planning—manually adding and removing users from dimension groups every time HR or IT updated Microsoft Entra ID.

By allowing Dataverse group teams backed by Entra groups to sit directly inside dimension security groups—while preserving separate membership views for group-backed teams and individual exceptions—Microsoft brings Business performance planning in line with modern zero-trust and role-based identity governance. Joiners and movers can inherit both their functional planning role and their exact departmental or scenario data slice from a single Entra group assignment, cutting down onboarding friction and reducing the risk of orphaned permissions during offboarding.