removing one permission from all Security roles

(0) Share

Report

Posted on by Ahmad Saud

790

dear all

i need to remove the permission of deleting Account and Case from all security roles (Except Administrator) , do i have to go through each and every security role and modify them? or there is a bulk way of doing this?

thanks,

Categories:

Customization / Solutions / SDK and API

All responses (14)

Answers (3)

Verified answer

RaviKashyap 55,410 Moderator on at

Like (0)

Report

RE: removing one permission from all Security roles

The one we have by default is Microsoft.Xrm.Sdk.Messages, the method "RemovePrivilegeRoleRequest " exists in Microsoft.Crm.Sdk.Messages
Ahmad Saud 790 on at

Like (0)

Report

RE: removing one permission from all Security roles

thanks Ravi

it is already there, please check.
Ahmad Saud 790 on at

Like (0)

Report

RE: removing one permission from all Security roles

thanks, i like the idea and will work to implement it.

regards.
Suggested answer

RaviKashyap 55,410 Moderator on at

Like (0)

Report

RE: removing one permission from all Security roles

Regarding your other questions, it is hard to tell that if system will work fine if you delete all delete permission from all entities/ roles. I haven't tried this yet but believes it should be fine.

In general, we don't use any out of box role, instead we create a copy of out of box role and assign that. We also create a base role with only the required permissions and without any delete permissions.

Hope this helps.
Suggested answer

RaviKashyap 55,410 Moderator on at

Like (0)

Report

RE: removing one permission from all Security roles

Hi Ahmad,

Sorry, I forget to mentioned that you need to add "Microsoft.Crm.Sdk.Messages;" namespace on the code now tool (right side pane).
Ahmad Saud 790 on at

Like (0)

Report

RE: removing one permission from all Security roles

Dear Ravi

i already did remove these permissions manually yesterday, but i wanted to try your code and i got the following error :

and in general, is there any harm to remove all delete permissions from all roles (except admin) for all entities assuming that none of my customizations or configurations are set to delete anything in any WF or BPF...etc.

in another words, does system assume that delete permissions is avaiable for certain OOB security roles in order to perform any system operation or not?

thanks,
Ahmad Saud 790 on at

Like (0)

Report

RE: removing one permission from all Security roles

thank you Ravi
Verified answer

RaviKashyap 55,410 Moderator on at

Like (1)

Report

RE: removing one permission from all Security roles

Hi Ahmad,

I am not sure if there is any tool which you can use to remove the specific privileges. As mentioned above, it would be quicker to remove the permissions manually (provided you don't have many roles). If you still want to automate then you can run the below code script on 'Code Now' tool to remove account delete & case delete privledges.

I have tried this and it seems working fine but it is always a good idea to test the script in sandbox/ test environment instead of directly rtying it against product. I have commented the main service.execute so that you don't run this by mistake.

======================

public static void CodeNow(){

var fetchXml = @"<fetch version='1.0' mapping='logical' distinct='false'>

<entity name='roleprivileges'>

<attribute name='privilegeid'/>

<attribute name='roleid'/>

<link-entity name='role' alias='roles' to='roleid' from='roleid' link-type='inner'>

<attribute name='name'/>

<filter type='and'>

<condition attribute='name' operator='neq' value='System Administrator' />

</filter>

</link-entity>

<link-entity name='privilege' alias='privileges' to='privilegeid' from='privilegeid' link-type='inner'>

<attribute name='name'/>

<filter type='or'>

<condition attribute='name' operator='eq' value='prvDeleteAccount' />

<condition attribute='name' operator='eq' value='prvDeleteIncident' />

</filter>

</link-entity>

</entity>

</fetch>";

var allRecordss = Service.RetrieveMultiple(new FetchExpression(fetchXml));

foreach (var record in allRecordss.Entities)

{

RemovePrivilegeRoleRequest removePrivilageRequest = new RemovePrivilegeRoleRequest()

{

PrivilegeId = new Guid(record["privilegeid"].ToString()),

RoleId = new Guid(record["roleid"].ToString())

};

//Service.Execute(removePrivilageRequest);

LogMessage(string.Format("Removed '{0}' privilege from '{1}' role.", ((AliasedValue)record["privileges.name"]).Value.ToString(), ((AliasedValue)record["roles.name"]).Value.ToString()));

}

}

=============

www.itaintboring.com/.../code-now-plugin-for-xrmtoolbox

www.itaintboring.com/.../lets-use-xrmtoolbox-to-run-some-c-code-into-dynamics

Hope this help.
Verified answer

gdas 50,089 Moderator on at

Like (0)

Report

RE: removing one permission from all Security roles

Hi Ahmad,

Go to top menu select tools , under that you can see plugins store . You need to choose the role updater and click on install.

Once installed , reopen XRMToolBox you will find the plugins.
Ahmad Saud 790 on at

Like (0)

Report

RE: removing one permission from all Security roles

Dear Goutam

the screen shot i attached earlier is from the XRMtoolbox store, it is not there in the store to install it.

thanks,