Dynamics 365: role and privilege for system administrator user

Question

In Microsoft Dynamics 365 Customer Engagement/ Sales, is it possible that an application user who has been assigned system administrator for the environment, might not have the privileges to access some of the data in the tables?

I have an application user who has system administrator permission, and while accessing some of the data using that application user, I am seeing:

Unable to enumerate rows. Error:0x80040220 - SecLib::CheckPrivilege failed. User: <id>, PrivilegeName: prvReadmsdyn_caseenrichment, PrivilegeId: 41f6f2f1-30c0-431f-b6c7-b8c97a274f5f, Required Depth: Basic, BusinessUnitId: <id>, MetadataCache Privileges Count: 5995, User Privileges Count: 4624

https://learn.microsoft.com/en-us/power-platform/admin/database-security#assign-security-roles-to-users-in-an-environment-that-has-a-dataverse-database

In this link, it has been mentioned that the system administrator permissions application user has full access to the Dataverse environment, with CRUD permissions on all entities.

score 2 · Accepted Answer · answered Jun 02 '21 at 13:20

2

A user that has the System Administrator role should be able to access all data in the system, so you are right to question why the error is happening.

The end of this article says that the msdyn_caseenrichment entity is part of the Customer Service Intelligence solution.

I'm not up to speed on that particular solution, but maybe the user is unlicensed for it, or something along those lines.

answered Jun 02 '21 at 13:20

Aron

3,877
3
14
21

We are using an application user to access the data. – EpsiophI Jun 02 '21 at 13:42
The corresponding Azure app has the tenant level permissions assigned to it to access CDS environment. – EpsiophI Jun 02 '21 at 13:42
Interesting. Maybe as an an experiment try the operation as a regular (non-application) user with the System Administrator role. – Aron Jun 02 '21 at 13:59

Henk van Boeijen · Answer 2 · 2021-08-23T12:42:42.657

2

On Dynamics 365 CE On-line this is indeed possible. There are certain actions that cannot be performed by application users. One example is turning on cloud flows, which can only be done by regular user accounts.

You can work around this limitation by making the application account impersonate a regular user.

edited Aug 23 '21 at 12:42

answered Jun 03 '21 at 12:41

Henk van Boeijen

7,357
6
32
42

Dynamics 365: role and privilege for system administrator user

2 Answers2