Converting Dynamics 365 Security Roles to Read-Only with PowerShell

 In Dynamics 365 / Dataverse, security roles often contain unintended modification privileges (Create, Write, Delete, etc.) even when they are meant to be read-only. Manually correcting them is time-consuming and error-prone — especially in environments with many custom entities.

This post shows how to safely convert existing roles into read-only roles using PowerShell.

---

The Problem

Roles labeled as “Read Only” still had privileges such as:

• Create

• Write

• Delete

• Append

• AppendTo

• Assign

• Share

The goal was to remove modification privileges while preserving:

• All Read privileges

• System-level privileges

• App and workflow functionality

---

The Solution

Using the Microsoft.Xrm.Data.PowerShell module:

1. Connect via Client Secret authentication

2. Retrieve the role

3. Fetch associated privileges

4. Remove only modification privileges

5. Leave system and read privileges intact

Import-Module Microsoft.Xrm.Data.PowerShell

$crmUrl = "https://yourorg.crm.dynamics.com"

$clientId = ""

$clientSecret = ""

$tenantId = ""

$conn = Get-CrmConnection -ConnectionString "

AuthType=ClientSecret;

Url=$crmUrl;

ClientId=$clientId;

ClientSecret=$clientSecret;

TenantId=$tenantId"

$rolesToFix = @(

    "AdvancedTemp - Read Only",

    "StandardTemp - Read Only"

)

# Only remove modification privileges

$removePattern = "^(prvCreate|prvWrite|prvDelete|prvAppend$|prvAppendTo|prvAssign|prvShare)"

foreach ($roleName in $rolesToFix) {

    $role = Get-CrmRecords `

        -conn $conn `

        -EntityLogicalName role `

        -FilterAttribute name `

        -FilterOperator eq `

        -FilterValue $roleName `

        -Fields roleid

    if ($role.CrmRecords.Count -eq 0) { continue }

    $roleId = $role.CrmRecords[0].roleid

    $fetch = @"

<fetch>

  <entity name='roleprivileges'>

    <filter>

      <condition attribute='roleid' operator='eq' value='$roleId' />

    </filter>

    <link-entity name='privilege'

                 from='privilegeid'

                 to='privilegeid'

                 alias='p'>

      <attribute name='privilegeid'/>

      <attribute name='name'/>

    </link-entity>

  </entity>

</fetch>

"@

    $privileges = Get-CrmRecordsByFetch -conn $conn -Fetch $fetch

    foreach ($priv in $privileges.CrmRecords) {

        $privId = $priv."p.privilegeid"

        $privName = $priv."p.name"

        if (-not $privId -or -not $privName) { continue }

        if ($privName -match $removePattern) {

            Remove-CrmRecordAssociation `

                -conn $conn `

                -EntityLogicalName1 role `

                -Id1 ([Guid]$roleId) `

                -EntityLogicalName2 privilege `

                -Id2 ([Guid]$privId) `

                -RelationshipName roleprivileges_association

        }

    }

}

Result

This script:

• Removes all modification privileges

• Preserves read and system access

• Prevents app or workflow breakage

• Automates role cleanup at scale

PowerShell provides a reliable and repeatable way to enforce true read-only security roles in Dynamics 365.

SDK: Create Email Using Template

        private static Guid CreateEmailMessageFromTemplate(IOrganizationService service, EntityReference contact, Guid templateId, EntityReference fromQueue)
        {
            InstantiateTemplateRequest request = new InstantiateTemplateRequest()

            {
                TemplateId = templateId,
                ObjectId = contact.Id,
                ObjectType = contact.LogicalName
            };
            InstantiateTemplateResponse response = (InstantiateTemplateResponse)service.Execute(request);
            Entity email = response.EntityCollection[0];
            var toActivityParty = new Entity("activityparty");
            toActivityParty["partyid"] = new EntityReference("contact", contact.Id);
            EntityCollection toParty = new EntityCollection() { EntityName = "activityparty" };
            toParty.Entities.Add(toActivityParty);

            var fromActivityParty = new Entity("activityparty");
            fromActivityParty["partyid"] = fromQueue;
            EntityCollection fromParty = new EntityCollection() { EntityName = "activityparty" };
            fromParty.Entities.Add(fromActivityParty);

            email.Attributes["to"] = toParty;
            email.Attributes["from"] = fromParty;
            return service.Create(email);
        }

Restrict Browser Back button

history.pushState(null, null, location.href);
    window.onpopstate = function () {
        history.go(1);
    };

Use the above code to restrict going to the back page from the current page.

This piece of code comes very handy when you are working on dynamics portals and you have logic where you should not allow users to navigate to back page.

Dynamics Portals Caching issue

When you change any portal configuration in CRM it doesn't gets reflected on the portals unless the portal is restated from the admin portal. This is very painful when we tend to do some small changes as it takes at least 2-3 mins to restart the portal.

Portal provides about page which has the clear cache option which can be used in this senarions. to access the page append the Portal URL + /_services/about

Make sure the user accessing this page is logged into the portal and have "administrator" web role

Error Connecting to Dynamics 365 Online from Report Viewer in VS

After entering connection details the connection dialog prompts for the credentials multiple times and this is because of the recent changes by Microsoft to he overall platform

ROOT CAUSE:
Its all because of the latest update in the Microsoft TSL(Transport Security Layer) Protocol in SDK assemblies..Microsoft allowed the TSL connection 1.0  and 1.1 for the browsers or client to connect the CRM org.Now Microsoft will support only TSL 1.2 or above going forward(Reference) . If you are connecting your org with the old version of plugin registration tool , then you may face this issue.


Uninstall Report Authoring Extension and install the latest.(Make sure Installed dll is the latest SDK 9.0). if this doesnt resolve the issue then follow the below step.


On the machine where VS is installed go to the start menu, then type run and then enter. Type in regedit and then OK.

Once the Registry Editor is open, go to: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319
Right click on the name of the folder (the v4.0.30319 folder) and select New, then DWORD. Give it the name of SchUseStrongCrypto and the Value of 1. Exit the Registry Editor, then restart your machine. 

SetStateRequest depricated in dynamics 365 online

SetStateRequest being deprecated now in Dynamics 365 (online).

use UpdateRequest to modify specialized fields.

Refer to the below link

https://msdn.microsoft.com/en-us/library/dn932124.aspx