Which permissions does a managed identity have on Microsoft Dataverse data?

Question

Options

• Apermissions assigned to the corresponding application user
• Bpermissions assigned to the user triggering the Azure resource
• Cpermissions equivalent to the environment admin role
• Dpermissions equivalent to the system administrator role

• A
  13% (2)
• B
  81% (13)
• D
  6% (1)

Explanation

When a managed identity accesses Microsoft Dataverse, it acts on behalf of the user who triggered the Azure resource - meaning it uses that user's Dataverse permissions rather than maintaining its own independent permission set. This delegated model ensures data access is governed by the triggering user's security roles, keeping access control consistent with existing Dataverse security policies.

Why the distractors are wrong:

• A is tempting but incorrect - while a managed identity does correspond to an application user in Dataverse, that application user's own assigned permissions are not what determine access in this delegated model; the triggering user's permissions take precedence.
• C is wrong because environment admin is a specific elevated role that is not automatically granted to a managed identity.
• D is wrong because system administrator grants full, unrestricted access - a far more permissive level than what a managed identity receives by default.

Memory tip: Think of a managed identity as a courier acting on someone else's behalf - it can only go where the person who sent it is allowed to go. The courier (managed identity) doesn't carry its own access card; it borrows the sender's (triggering user's).

No community discussion yet for this question.