Finance | Project Operations, Human Resources, ...

How to segregate Development and Deployment role in LCS

(1) Share

Report

Posted on by sohaiby

Hi.

We are using D365 Finance and Operations (Cloud deployment). We have an audit requirement where we need to segregate the development and deployment roles. In LCS Project settings, the Environment manager (Project security role) gives you access to manage all the environments, including the DevBox, and also to publish deployable packages in the production environment.

Is there a way to create separate roles for development and deployment, so that the developer doesn't have access to deploy the package, and only has access to manage the DevBox and Sandbox environment? Alternatively, can there be an approval process for the deployable package, so that it needs to be approved by another user before it could be published to the production environment?

Thanks.

I have the same question (0)

All responses (6)

Answers (0)

Suggested answer

Anthony Blake 2,963 Super User 2025 Season 2 on at

Like (2)

Report

There's no way to setup roles in LCS that aren't out of the box, its pretty limited.

Your developers however don't actually need access to LCS at all if that's a problem, your environment managers could provide them with RDP & credentials from LCS.

Was this reply helpful? Yes No
Suggested answer

MuthukumaranAX 2,903 on at

Like (0)

Report

You can't custom role in LCS project, please refer the below link and chose the right role that suits your requirement.

https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/lifecycle-services/configure-lcs-security#configuring-project-security

Secondly, you have marked the package as "Release candidate" that indicate that the package is ready for production instance.

Was this reply helpful? Yes No
sohaiby 7 on at

Like (0)

Report

@Anthony Blake Thank you for your answer. Taking away the complete LCS access would mean that the Developer won't be able to manage sandbox, apply updates and manage LCS settings. Our requirement is to only segregate the deployment to production role, while they can continue to manage the rest of the LCS settings.

Is there a package approval workflow in LCS (similar to the x++ custom script deployment) that could be enabled?

Was this reply helpful? Yes No
sohaiby 7 on at

Like (0)

Report

Hi MuthukumaranAX, Thanks for your response.

Is there a way that the Developer (with Environment manager role) who deployed the package to Sandbox won't be able to Mark it as Release Candidate, and only a different user (with either Environment manager or Project Owner role) can do it? This will act as an extra level of security and will pass our audit requirement.

Was this reply helpful? Yes No
André Arnaud de Cal... 301,069 Super User 2025 Season 2 on at

Like (0)

Report

Hi Sohaiby,

You have a follow-up question where the developer does have environment manager access on the LCS project and should not start the deployment. In this case, it is not possible to stop them from deploying a deployable package. Note that LCS will be deprecated and all environment access will be managed in the Power Platform admin center in the future. We should check if development and deployment can be separated in a better way. I can bring your question to Microsoft.

For now, the only option would be taking away the LCS role from the developers as mentioned below.

Was this reply helpful? Yes No
Suggested answer

DD-10121038-0 2 on at

Like (0)

Report

Give the Developers the Project security role as "Operations User" and Implementation Role as "Technical Consultant", This should help with your Audit passed.

thanks

Dilliraj

Was this reply helpful? Yes No