A Dataverse user record represents a licensed person (synced from Microsoft Entra ID / Azure AD) who can sign in and interact with the environment. A handful of settings on the user record matter more than they first appear to.
Business unit assignment
Every user belongs to exactly one business unit at a time, which directly affects what Business Unit-level security roles grant them access to. Moving a user to a different BU is possible but, as covered earlier, can have real knock-on effects for record visibility — not something to do casually once a user has been active.
Licensing and access modes
A user needs an appropriate license (Sales, Customer Service, Power Apps, etc.) assigned before they can meaningfully use the relevant app, independent of whatever security roles they’re given — a user can have perfect security roles and still be unable to open an app because the underlying license isn’t assigned.
Disabling vs. deleting users
Dataverse users are essentially never hard-deleted — when someone leaves, the standard practice is to disable their user record rather than delete it. Disabling blocks sign-in while preserving all the record history, ownership references, and audit trail tied to that user. Deleting a user can break historical reporting and orphan references in ways that are hard to fully undo.