Minimum Security Privilege to assign security roles and update User records?

(0) Share

Report

Posted on by Cyclefitness

I need to configure a business user to have the privilege to do the following, but not have global Administrator privileges. I'm going to call the role "Business Customizer." What is the minimum privilege for each of these tasks?

Assign security roles and update other attributes on the User record.
Update Global Option Sets.

Thank you!

*This post is locked for comments

I have the same question (0)

All responses (4)

Answers (1)

Cyclefitness on at

Like (0)

Report

Ouch. That means when deploying and if you want to give the business the ability to change security roles, you have to give them Admin. That's a bad thing.

Was this reply helpful? Yes No
Cyclefitness on at

Like (0)

Report
I came up with a solution which allows me to give a person who functions as a security liaison with the business a "Security Liaison" role with privileges to update Users - WITHOUT giving them full admin privileges.

Basically, I've accomplished this by trimming the Site Map to only show items them have access to.

I created a "dummy" entity named "securityuser" -- the name includes the entity I want to give them access to; i.e., User.

I created a "Security Liaison" Security Role to have "Read" privilege to that dummy entity.

I added a "User" SubArea on the SiteMap with the Privilege attribute to the securityuser entity with read.

Works like a charm!

Now my question is, I assume there is a way to get around that by entering the URL to other Admin areas directly in the Address bar?

Was this reply helpful? Yes No
Verified answer

Community Member on at

Like (0)

Report

1) Security 101:

A user cannot grant privileges that they do not already have themself. So your "customizer" users would need rights to write to user entity, append to user entity and append to Security Role entity (because it is an N:N relationship you need append TO on both).

They must also have a role that has all the roles that every other role has, or they need tohave every other role that they might need to assign.

Was this reply helpful? Yes No
Cyclefitness on at

Like (0)

Report

That does help, Adam and makes me feel much better. I can create a Security Liaison role with just those privileges. I don't want that person to be able create a Security Role or modify the Security Role.

Was this reply helpful? Yes No

Community site session details

Minimum Security Privilege to assign security roles and update User records?

Helpful resources

Quick Links

Responsible AI policies

Neeraj Kumar – Community Spotlight

Congratulations to the November Top 10 Community Leaders!

Leaderboard > 🔒一 Microsoft Dynamics CRM (Archived)

Featured topics

Product updates

Community site session details

Minimum Security Privilege to assign security roles and update User records?

Helpful resources

Quick Links

Responsible AI policies

Neeraj Kumar – Community Spotlight

Congratulations to the November Top 10 Community Leaders!

Subscribe to this forum!

Select categories

Leaderboard > 🔒一 Microsoft Dynamics CRM (Archived)

Featured topics

Product updates