Applies to Product - Dynamics 365 Project Operations
What’s happening?
A user is able to submit time entries for other users. This has raised concerns regarding the permissions and access levels assigned to the user.
Reason:
The user has been found to have global access for the time entries entity, which allows them to submit time entries for others. However, there are UI restrictions in place to prevent users from accessing views that expose other users' time entries.
Resolution:
- If applicable, remove global access and assign user-level access for time entry to the affected user to check if this persists.
- Investigate which view or option the user had access to that allowed them to submit time entries on behalf of others. By default, most of the out of box views for Time Entry are limited to only display those records related to the current user.