Customer experience | Sales, Customer Insights,...

An user with Administrative Access Mode can change the Business Unit?

(1) Share

Report

Posted on by SrinivasKamutam

Hi All,

Can anyone help to clarify the below query? Any help is appreciated.

We have an user with Access Mode = Administrative and System Administrative security role to deal all the administrative requests. Wanted to change a Business Unit for one of the user using the respective Administrative account but encountering a privilege issue as mentioned below and unable to change the Business Unit.

Understand the privilege is referring to read/write permission on calendar entity but is it expected? Why cannot Business Unit change for an user considered under Administrative task and work in my scenario without any privilege issue? Any solution to solve my problem with the same administrative account?

Unhandled Exception: System.ServiceModel.FaultException`1[[Microsoft.Xrm.Sdk.OrganizationServiceFault, Microsoft.Xrm.Sdk, Version=9.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]]: System.Web.HttpUnhandledException (0x80004005): Exception of type 'System.Web.HttpUnhandledException' was thrown. ---> Microsoft.Crm.CrmException: SecLib::AccessCheckEx2 failed. Returned hr = -2147187962, ObjectId: <Object Guid>, OwnerId: <Guid.Empty>, OwnerIdType: 8 and CallingUser: <UserGuid>, CallerBusinessId: <BU Guid>. ObjectTypeCode: 4003, ObjectBusinessUnitId: <Object BU GUID>, AccessRights: ReadAccess. Computed rightsToCheck=ReadAccess, grantedRights=8, hsmGrantedRights=None, grantedRightsWithHsm=8.

Thanks!!

I have the same question (0)

All responses (7)

Answers (0)

Prakash Kalimuthu on at

Like (1)

Report

Hi SrinivasKamutam,

Yes, it is possible to change business unit of other users using admin user.

Can you please share the screenshot of the error?

FYI, whenever BU gets changed for user, security role gets disassociated. After changing BU, associate security role to the user.

Regards,

Prakash

Was this reply helpful? Yes No
Suggested answer

Claudia Amaral on at

Like (0)

Report

Hello Srinivas,

An Administrative user can update a Business Unit for another user.

An Administrative user is a user who has access to the Settings and Administration features but has no access to any of the functionality. Use this account to assign administrative users to perform day-to-day maintenance functions (create user accounts, manage security roles, and so on).

Please see this documentation: https://docs.microsoft.com/en-us/power-platform/admin/create-users-assign-online-security-roles#create-a-read-write-user-account

The user still need to have the System Admin role to perform these actions.

If this answer was helpful to you please mark it as an answer. Thank you!
Thank you for using Microsoft Dynamics CRM Communities.

Cláudia Amaral

Support Engineer
Microsoft Dynamics CRM

Was this reply helpful? Yes No
SrinivasKamutam 30 on at

Like (0)

Report

Hi Prakash,

Thanks for your response. I have attached the error in my query which is asking for read privileges on Calendar entity.

Thanks.

Was this reply helpful? Yes No
Prakash Kalimuthu on at

Like (0)

Report

Hi SrinivasKamutam,

If you are trying with system admin he will all the privileges.

If not system admin, then you need to provide necessary privilege to the user. There are inbuilt functionalities which gets triggered if we perform any operations.

Regards,

Prakash

Was this reply helpful? Yes No
SrinivasKamutam 30 on at

Like (0)

Report

Hi Amaral, Thanks for your response.

Yes I am expecting the same that administrative user should be able to change the business unit but it is giving me a privilege issue asking for read/write permissions (error mentioned in my query) on calendar entity. So, I am curious to understand why it is not considered as administrative task and work without issue despite having system administration security role.

Understand that the Business Unit for the Calendar entity will also updated when changing the Business Unit of the User but it should be considered under administrative tasks and work in my case. So, I am confused and wanted to check if it is a product issue or designed to be like that and also looking for solutions.

Was this reply helpful? Yes No
Suggested answer

Claudia Amaral on at

Like (0)

Report

Hello Srinivas,

If the error message states a missing permission for Calendar entity, I suggest you to check if the user have the following permissions:

A User contains Work Hours and these Work Hours are in a Calendar. So, it makes sense that we need to have access to a Calendar.

If this answer was helpful to you please mark it as an answer. Thank you!
Thank you for using Microsoft Dynamics CRM Communities.

Cláudia Amaral

Support Engineer
Microsoft Dynamics CRM

Was this reply helpful? Yes No
ShannonCRM 502 on at

Like (0)

Report

Just wanted to let you know I am having the same issue.

If we set the Business Unit correctly before the first save of the new user, it's no issue, but we can't change it.

I opened a ticket with Microsoft and will let y'all know what I learned.

Was this reply helpful? Yes No