[CoE Starter Kit - BUG] Inactive users are not removed on table "Environment security role permissions"

[wilmanmtl]

Does this bug already exist in our backlog?

• I have checked and confirm this is a new bug.

Describe the issue

Hello,

Our administrator removes environment roles from users who have left the company. These users are now inactive in both Entra ID and Dataverse. However, they are not automatically removed from the "Environment security role permissions" table, which causes confusion. When we review the CoE (Center of Excellence) application, it appears that these users still hold roles in certain environments, even though they are no longer have assigned roles.

View on CoE

User have any role, they were removed some weeks before

Expected Behavior

We expected users were removed from the table "Environment security role permissions" even is they are inactive or at least the records on table can have status inactive and we can filter on our views.

What solution are you experiencing the issue with?

Core

What solution version are you using?

4.50.3

What app or flow are you having the issue with?

SYNC HELPER - Get Security Role Users

What method are you using to get inventory and telemetry?

Cloud flows

Steps To Reproduce

1. Assign roles to existant actif user
2. Check the table, it must be a new line with the direct role assigned on table "Environment security role permissions" after sync automate execute
3. Disable user on envrionment or entraId
4. Remove roles from the environment
5. Run automate sync security roles or wait until automatic sync runs
6. Check the table again
7. The user is still there with the former role and environment, the record is actif so we can not validate the assigment is not longer real

Anything else?

No response

[mohamrizwa]

Hi @wilmanmtl,
The sync flow does not currently validate user status in Entra ID or Dataverse before updating the table. This means that even if a user is disabled, their previous role assignments persist as active records.
There is no built-in logic in the "SYNC HELPER - Get Security Role Users" flow to mark records as inactive or remove them based on user status.

[wilmanmtl]

Hello @mohamrizwa , thanks for your answer, that confirms the current behavieur. Is this feature already planned for a new release ? Otherwise how can I propose this for the future ? I think it can be useful for other CoE users :)

[mohamrizwa]

Hi @wilmanmtl,
We are taking this into backlog. For now, we are closing this ticket.

[wilmanmtl]

Thanks so much @mohamrizwa :) , Could you send me the new ticket id reference? I’d like to keep an eye on it for future follow-up and use in our CoE