Share
ReportHi everyone,
I'm looking for real-world experiences on a governance dilemma we're facing with Customer Insights - Data + Customer Insights - Journeys in the same environment.
I'm looking for real-world experiences on a governance dilemma we're facing with Customer Insights - Data + Customer Insights - Journeys in the same environment.
Our marketing users need to:
Create and manage segments and measures in CI Data
See segments and measures created by other users (cross-user visibility)
Export segment members to Excel directly from the CI Data UI
Work across business units (no BU restriction)
Manage journeys and marketing content in CI Journeys
See segments and measures created by other users (cross-user visibility)
Export segment members to Excel directly from the CI Data UI
Work across business units (no BU restriction)
Manage journeys and marketing content in CI Journeys
The problem
The Marketing Contributor role in CI Data doesn't allow Excel export of segments and hides measures/segments created by other users — the restriction seems hardcoded in the app UI, not just at the Dataverse privilege level.
The Contributor role solves all functional requirements, but Microsoft's official role mapping forces the assignment of Environment Maker and System Customizer at Dataverse level, which is a governance concern for us (users could theoretically create custom tables, flows, apps in a business-critical environment).
Official docs explicitly state: "do not remove or modify the assigned Dataverse role mappings".
The Contributor role solves all functional requirements, but Microsoft's official role mapping forces the assignment of Environment Maker and System Customizer at Dataverse level, which is a governance concern for us (users could theoretically create custom tables, flows, apps in a business-critical environment).
Official docs explicitly state: "do not remove or modify the assigned Dataverse role mappings".
Has anyone successfully implemented a least-privilege configuration for CI Data Contributor users that removes or mitigates Environment Maker / System Customizer privileges without breaking functionality?
Is anyone relying purely on environment-level guardrails (DLP policies, Managed Environment, connector restrictions) to make Contributor "safe"? What's been your experience — any pitfalls?
Has anyone tested cloned/custom Dataverse roles as replacements for the mapped ones? Did the CI Data UI still recognize the user as Contributor?
Any hint from Microsoft roadmap about more granular CI Data roles between Marketing Contributor and Contributor?
Any input — success stories, workarounds, or "we tried and it broke" — is very welcome. Happy to share our final approach back with the community.
Thanks in advance 🙏
Categories:
I have the same question (0)
All responses (
Answers (
119
