there is no native flag in the UI or a SECURITYROLEIDENTIFIER column that explicitly labels a role as standard versus custom — the Security roles list merges both without visual distinction. The reliable way to separate them is by checking which model the role belongs to in the application metadata.
Method 1 — SQL query against model metadata (most reliable)
SELECT
r.NAME AS RoleName,
r.LABEL AS RoleLabel,
m.NAME AS ModelName,
CASE
WHEN m.NAME IN ('ApplicationSuite', 'Foundation', 'Platform', 'Organization', 'Directory')
THEN ‘Standard Microsoft’
ELSE ‘Custom / Partner’
END AS RoleClassification
FROM SECURITYROLEDETAIL r
JOIN MODELMANIFEST m ON r.MODELID = m.ID
Standard Microsoft roles sit in ApplicationSuite, Foundation, Platform, Organization, or Directory models. Anything else is custom or partner-built.
Method 2 — Visual Studio Application Explorer (if you have dev access)
Navigate to Security > Security Roles in Application Explorer. Check the Model property on each role — ApplicationSuite or Foundation means standard Microsoft, your custom model name means custom.
Method 3 — Security Configuration form
Roles created dynamically via System administration > Security > Security configuration sit in application data tables rather than metadata packages. Check the Roles tab — roles created here will often show unpublished changes or sit outside standard metadata.
Method 1 gives you the cleanest exportable list in one run.
It it helps mark as verified.
