Finance | Project Operations, Human Resources, ...

How to monitor for role changes

(4) Share

Report

Posted on by DO-03010005-0

Have a situation where I need to monitor when users are added to a privileged specific user role.

How can I export the list of users in a role or set a rule to check for these routinely?

Looks like the backing role table: SecurityRoleAssigned isn't supported by the Power Platform table.

Looks like System administration > Security >Assign users to roles
doesn't have a way to export the user list.

Trying not to enable API services.

I tried setting auditing on the tables on the securityRole and User tables but I don't see where to set auditing for the SecurityRoleAssigned and I don't see the changes logged to the audit trail.

I am not familiar with the product so please excuse my ignorance.

Categories:

Dynamics 365 Finance

I have the same question (0)

All responses (7)

Answers (0)

Sort by

Suggested answer

Abhilash Warrier 7,274 Super User 2026 Season 1 on at

Like (0)

Report
Copy link

Link copied!
Hi,
Have you tried the below reports under Inquires > Security-

User role assignments

Security role access

Role to user assignments

Security duty assignments

Enable auditing for user role changes. Although you mentioned difficulty with auditing the SecurityRoleAssigned table, ensure auditing is enabled for related tables like SecurityRole and User. This can help track changes

Was this reply helpful? Yes No
Suggested answer

Bharath jain 1,524 Super User 2026 Season 1 on at

Like (0)

Report
Copy link

Link copied!

Hi,

You can go to system administration > Security > security configuration

Select Role > click on view permission

You can download all the changes

Regards,

Bharath Jain

Was this reply helpful? Yes No
André Arnaud de Cal... 303,756 Super User 2026 Season 1 on at

Like (0)

Report
Copy link

Link copied!

Hi,

Can you provide the full requirement please? You are mentioning a lot of details in your question, but how are you ising Power Platform, or API services? What exactly do you mean by "setting auditing on the tables"? Did you enable database logging in Dynamics 365 F&O?

Depending on a complete description of your functional requirement, we can suggest the best option for you. There is a data entity that can be used to list the roles assigned to users. The new User Security Governance also has additional logging and a privileged role assignment feature.

Was this reply helpful? Yes No
DO-03010005-0 18 on at

Like (0)

Report
Copy link

Link copied!

Thank you all.

The requirements are simple, to have a team alerted when a user is added to a privilege role.
Currently due to leadership decisions beyond my control we have too many System Administrators and System Admins are continually adding others whenever there is an access issue that we are working to prevent.

Yes we can manually go review a list of System Administrator and then export.

If there was a way to send this list as csv to email, that would meet my requirement.

We are looking for a way to export this routinely or to alert based on a role change.

Yes I have enabled auditing on both the SecurityRole and User tables, but changes are not tracked.
When I make a change there is no log in the audit trail.

I believe this is because neither table handles user assignments too a role. I believe there is a table not visible in either the Power Platform, the API, or the FNO Solutions listing called: SecurityRoleAssigned ( systemuserroles_association in the N:N relationship map in User entity solution)

If the role user list table was audited in and changes recorded in Audit trail it would meet the requirement.

If the table was published to Power Platform or accessible to API it would meet the requirement, although I may not be granted approval to change the publishing of this table it if reduces security.

Any suggestions are greatly appreciated. :)

Was this reply helpful? Yes No
DO-03010005-0 18 on at

Like (0)

Report
Copy link

Link copied!

Any thoughts on why role changes aren't auditable or suggestions to email a list of users?

Was this reply helpful? Yes No
Suggested answer

André Arnaud de Cal... 303,756 Super User 2026 Season 1 on at

Like (1)

Report
Copy link

Link copied!

Hi,

Thanks for the clarification. I just tried setting up a Power Automate flow to get an alert in case the system admin role is assigned to any user in the application. This is working.

I will write a more detailed blog, but here already a way to get you started. I my example, as a pre-requisite you will need to have Virtual entities configured for your Dynamics 365 F&O linked to a Power Platform environment.

Go to the form Business events catalog. On the tab Data event catalog find records beginning with DataEvent_SystemSecurityUserRoleAssociationEntity. You can enable these as data event. When a dialog opens with an endpoint, close the form.

You can then create a Power Automate flow like the one below using the table Security user role association (mserp). In the filter, you can limit the actions to alert only for the System administrator role assignment. You can choose to send an email to yourself, or specify a list. You can also choose to send a mobile or Teams notification in case an user is assigned to the system administrator role. I have attached the Power Automate flow to this reply.

Systemadminassign...

Was this reply helpful? Yes No
Vahid Ghafarpour 12,228 Super User 2026 Season 1 on at

Like (1)

Report
Copy link

Link copied!

If any of the responses helped resolve your issue, please take a moment to mark the best answer. This helps others in the community quickly find solutions to similar problems.

To do this, simply click the "Does this answer your question?" button on the most helpful response and like the helpful posts. If your issue is still unresolved, feel free to provide more details so the community can assist further!

Thanks for being an active part of the Dynamics 365 Community!

Was this reply helpful? Yes No