How can we identify who has access to a record in a Dataverse table?

[RobHardy]

Is there a straightforward way of determining which users have access to a record in a Dataverse table, from (e.g.) Power Automate?

Considering the complex permission structure of Dataverse (Owner / Role / Shared / Hierarchy access), it can be difficult to track permissions. I was wondering if there was a simpler way to check this (e.g. an API call)?

Thanks,

Rob.

[gulshankhurana]

Hi @RobHardy 

There is a 'Check Access' button available on forms which  an provide this information you seek.

There's also a tool in xrmtoolbox 'Access Security Roles' you can use.

https://www.xrmtoolbox.com/plugins/AccessSecurityRoles/

https://powerusers.microsoft.com/t5/Microsoft-Dataverse/View-security-roles-that-have-permissions-to....

Kind regards 

Gulshan

Please give it a thumbs up 👍🏻 if you appreciate my efforts.

If my answer helped you resolve your issue then please also mark it as a solution ✅  so that it helps others experiencing the same problem.

[RobHardy]

Thanks, @gulshankhurana,

Do you know if there's a way of doing this programmatically, though? There are use-cases where checking manually isn't practical, such as synchronising permissions between Dataverse and SharePoint.

[gulshankhurana]

Hi @RobHardy 

I'm sorry, I am not aware if/how it is possible to achieve programmatically.

Kind regards 

Gulshan

Please give it a thumbs up 👍🏻 if you appreciate my efforts.

If my answer helped you resolve your issue then please also mark it as a solution ✅  so that it helps others experiencing the same problem.

[RobHardy · Accepted solution]

Thanks anyway, @gulshankhurana - you did give me a clue on how to solve this. I used the Check Access tool along with the browser's developers' tools, and found that it was submitting a number of Fetch XML queries. This one lists users with access to the record via security roles: 

In order to get this working in a flow, a few changes were needed:

• Remove distinct='true' from the root element (aggregation isn't supported by List Rows in Power Automate - I used the trick of union-ing the returned array of users with itself to filter down to distinct users).
• Remove count='8' and use a suitably high number for row count to ensure all users are returned.
• value='2' for accessright appears to return users with write-access to the record, while value='1' returns those with read access.
• I constructed the business unit hierarchy using a Do Until loop and Append to string variable 

There were three other Fetch XML queries, one listing teams with access, one listing application users, and one listing users with access via the Share functionality.

[gulshankhurana]

Hi @RobHardy 

Oh wow. 😀

You could perhaps write a blog post about it and share it on LinkedIn as I'm sure there'll be many people out there who could benefit from your experience.

Being purely functional and without any tech background, I naturally tend to look for solutions that don't involve code. Having said that, albeit manual, I'm glad my clue led you to your own discovery path. You could in fact mark it as a solution too as you're allowed to mark more than one answers as a solution.

Kind regards

Gulshan