Prevent a user from accessing the 'Customizations' area

(0) Share

Report

Posted on by Rusty Jake

Hi Folks.

I am in the process of building a custom security role for the purposes of a 3rd party user accessing our organization. I need to prevent the user from accessing the Customizations area, within the settings tile.

At the moment when loggin in as the 3rd party user, I can view the 'developer resources' section within customizations, which is not acceptable for the 3rd party to view or access.

Unfortunately I have been unable to prevent this using the custom security role, if possible I would like to know the entity name within the security role configurator that I need to revoke privileges from?

Alternatively, is there a way of applying another security layer to this area? similar to how field security is handled? (Admin only for example)

Any suggestions would be greatly appreciated.

Dynamics version - Version 1710 (9.1.0.10535) online

Thanks

All responses (4)

Answers (0)

David Jennaway 14,065 on at

Like (0)

Report

RE: Prevent a user from accessing the 'Customizations' area

There's no effective way to stop a user seeing metadata. They need to able to read metadata to be able to use CRM, and there is no way to selectively allow access to the metadata for certain entities.

Even if you restricted access to which pages are available through the SiteMap, it's relatively simple for a user to another tool, like XrmToolbox, to get the metadata
a33ik 84,331 Most Valuable Professional on at

Like (1)

Report

RE: Prevent a user from accessing the 'Customizations' area

With Url from a browser I mean the addresses of 365 endpoints available in the "Developers Resources" page. Let's forget about this.

Can you please comment on Unique Id and metadata? What could be done with those 2 things available to a user?
Rusty Jake 10 on at

Like (0)

Report

RE: Prevent a user from accessing the 'Customizations' area

Hello

I am not happy that the user would be able to access unique ID's or be able to download the xml files containing metadata.

Are you able to clarify what you mean by they can get a url just from the browser? Is this a method someone could use to access a menu or section that has been hidden?

Thanks
a33ik 84,331 Most Valuable Professional on at

Like (1)

Report

RE: Prevent a user from accessing the 'Customizations' area

Hello,
"Developer resources" page contains urls... When person accesses Dynamics he/she can get url just from the browser. What kind of information do you want to protect not allowing user to see that page?