Yes — this one is unfortunately well-known, hard to diagnose, and not related to your app configuration.
When images appear for some users but not others in a model-driven app rich text field, the issue is almost always one of the following three root causes — and all of them are environment / browser-storage related, not table or form related.
Below is how this actually works under the hood and what to check.
✅ How images in Rich Text fields actually work
When a user pastes or uploads an image into a Dataverse rich text field:
-
The image is not stored as a file
-
It’s embedded as base64 HTML
-
Or referenced as a temporary blob URL
Example stored HTML:
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA..." />
or sometimes:
<img src="blob:https://org.crm.dynamics.com/83a4..." />
This is important.
🔴 Why some users see images and others don’t
✅ Reason #1 — Browser storage limits (most common)
Browsers enforce per-site storage quotas.
If a user:
…the browser may silently block rendering.
Symptoms:
This happens most often in:
✔ Fix
Ask affected users to:
Clear site data for:
https://*.dynamics.com
Not full cache — site data specifically.
🔴 Reason #2 — Attachment privilege missing
Even though the image is “inline”, Dataverse still enforces attachment read privileges.
If the user lacks:
Images fail to render.
Why?
Because the rich text editor internally stores and retrieves image blobs via the annotation pipeline.
✔ Check security role
Users must have:
Notes (Annotation)
✔ Read
✔ Append
✔ Append To
Many custom roles accidentally remove this.
This explains why:
-
admins can see images
-
some users cannot
🔴 Reason #3 — Mixed domain / CSP blocking
If your tenant has:
Image URLs can be blocked.
Especially if images reference:
blob:https://xxxxx.crm.dynamics.com
Some security policies block blob rendering.
✔ Check:
🔴 Reason #4 — Old records using legacy editor
Dataverse had two different rich text editors:
-
Legacy RTE
-
Modern RTE (post-2023)
Older records may contain HTML like:
<img src="/Image/download.aspx?entity=annotation&id=..." />
This fails for users without annotation privileges.
Newer ones use base64.
So you’ll see:
-
old records broken
-
new ones fine
✅ Things that do NOT cause this
❌ Browser type
❌ App configuration
❌ Form XML
❌ Column settings
❌ Field security profiles
❌ Canvas vs MDA
✅ What to check — in order
1️⃣ Confirm Notes permissions
Security role must include:
Annotation
Read ✔
Append ✔
Append To ✔
This fixes ~60% of cases.
2️⃣ Ask affected users to clear site data
Not cache — site data only.
Edge:
Settings → Cookies → All site data → dynamics.com → Remove
3️⃣ Compare HTML source
Open the record → inspect HTML.
If image source is:
blob:
or
/Image/download.aspx
then it is permission or CSP related.
4️⃣ Check Conditional Access / Defender policies
Specifically:
-
inline images
-
blob URLs
-
base64 rendering
✅ Recommended long-term solution
If images are business-critical:
✔ Stop using rich text for image storage
Use instead:
Then reference images rather than embedding them.
✅ Summary
| Cause |
Affects |
| Browser site storage |
Some users only |
| Missing Annotation read |
Security-based |
| CSP / blob blocking |
Corporate devices |
| Legacy HTML |
Older records |
✅ Most common fix
Give users Read permission on Notes (Annotation).
This alone resolves the issue in most tenants.
