Microsoft Dataverse: Add users without licenses to activity recipient fields

🚨 The Signal: Dataverse now allows adding unlicensed Entra users as activity recipients. These users cannot access Dataverse apps, but their identities are present, potentially expanding the attack surface for identity-based attacks if not properly managed.

The Impact

Identity and Access Management teams are affected by the expanded scope of user identities within Dataverse, increasing the risk of orphaned accounts or misconfigurations.

• Identity Teams: Increased risk of managing inactive or orphaned user records in Dataverse.
• Security Teams: Potential for expanded attack surface if disabled accounts are compromised.
• Compliance Teams: New considerations for data privacy and user lifecycle management.
• Audit Teams: Need to verify that disabled accounts truly lack access and are not exploitable.

The Action

1. Review existing Dataverse user provisioning and deprovisioning policies to include unlicensed users.
2. Implement regular audits of disabled Dataverse user accounts to ensure they remain inactive and are removed when no longer needed.
3. Update identity governance processes to track the lifecycle of unlicensed users added to Dataverse.
4. Communicate the change to relevant security and identity teams to ensure awareness and policy updates.

Domain: Entra · Impact: medium · Workload: Entra ID