Security - Child BUs and Security Roles

(0) Share

Report

Posted on by Gerard Simpson

2,987 Moderator

Hi - I'm configuring security in Dataverse with Parent and child BUs and I want to align different security roles to the child BUs, so I can leverage BU scope access.

I can set up new security roles in the admin centre and align them directly to a child BU using the new security role form at the point of creation - but when I try and add the same security role to a solution, I get an error like this:

'Subcomponent 1111111-e111-ef11-b1e1-1111111111 cannot be added to the solution because the root component Role is missing'

If I copy an existing role, there is no way to align that just to the child BU, it creates a copy of that role for all BUs even though I just want a role for a specific BU.
Is this duplication/cascading behaviour of new roles across all BUs expected behaviour for all parent child BU scenarios?

Can I configure it just to add a role for a child BU, which is ideally copied from an existing role and with the ability for it to be added to an existing solution?

Thanks

Categories:

Microsoft Dataverse with Power Apps

I have the same question (0)

All responses (2)

Answers (0)

NA-07071242-0 2 on at

Like (0)

Report
Copy link

Link copied!

Hi Gerard

I run into the same problem for my organisation.

I want to deploy the custom security roles in my solutions via Power Platform Pipelines. The custom security roles are bonded to a child business unit. I got the same error message as you.

Could you solve the problem? Would be nice to learn from your solution.

Thanks, Nico

Was this reply helpful? Yes No
Suggested answer

Gabriel G. 831 Super User 2025 Season 2 on at

Like (0)

Report
Copy link

Link copied!

Hi there,

When you create security role component, you create the template for everything you gonna assign to it. What I mean ? I mean you creating the container which contains the privileges you need on different levels (org, bu, user, etc).

So, once you configured your security role component, when you will give a role to a user, you will select in which BU you want to give the role (or it will take the BU from user or team).

What I recommend for maintaining cleanliness on your roles is to create your security roles as you did already I think. Then, you create teams for user roles and you named them properly (like 'Agent Manager' or whatever you need). On this team, you select the appropriate BU and you give role(s) you need for users in it. All you need to do after is to add/remove users to this team. You need another BU for this role ? You create another team with the appropriate BU and same roles. Basta!

Let PowerPlatform mechanics handle everything else ;)

For everything about deploying, you simply move your security role component in a solution and export it as usual. ***Roles records will not migrate, you need to script it or reconfigure your teams in your other environment***

N.B.: Make sure your roles hierarchies are set to:

I hope it helps!
_______________________________________________________________________________

Please click Does this answer your question if my post helped you solve your issue. This will help others find it more readily. It also closes the item. If the content was useful in other ways, please consider giving it a Like.

Was this reply helpful? Yes No