Edit

Permission changes overview

This article details permission changes for the out-of-the-box roles in Customer Insights - Journeys. Whether you're an administrator configuring roles or a user checking your access level, use this article as your reference for what each role can do.

Note

The content and structure of this page changed significantly since April 2026. If you used this page to keep custom roles aligned with out-of-the-box roles, review the entire article to understand what changed and how role updates are now documented.

List of out-of-the-box roles

  1. Event Administrator
  2. Event Administrator (BU level)
  3. Event Planner (BU level)
  4. Lead Score Modeler
  5. Lead Score Modeler (BU level)
  6. Lead Score Viewer
  7. Lead Score Viewer (BU level)
  8. Marketing Manager - Business
  9. Marketing Manager (BU level) - Business
  10. Marketing Professional - Business
  11. Marketing Professional (BU level) - Business

BU stands for business unit. Roles marked "(BU level)" are scoped to a single business unit rather than the entire organization.

How to use information in this page

If your organization uses custom roles based on out-of-the-box roles, with specific privileges added, removed, or changed to match your business needs, you need to keep those custom roles in sync as the product evolves. Out-of-the-box roles can change with each release when new capabilities are added or existing capabilities are updated. Review the Release-wise changes to roles and privileges section regularly and apply the documented changes to your custom roles.

Earlier versions of this article listed every privilege for each role. That format was difficult to maintain and made it hard to identify what changed between releases. Starting with the March 2026 release, this article uses a changelist format that documents only the differences from one release to the next. We're also now documenting privileges for all eight actions (previously, we documented only five actions: Read, Write, Create, Append, AppendTo, Delete).

Here's how the information is organized:

To keep your custom roles in sync, first align them with the documented baseline. Then apply each release's permission changes, up through your current release, to bring your roles up to date. After that, check this page after every release for new changes to apply.

How to check privileges for any role

For the most accurate and up-to-date privilege information, check roles directly in the application. Follow the steps in Security roles and privileges for Dataverse to find configured roles and their privileges.

Dataverse security roles combine an action (for example, Read or Write) with an access scope that defines how broadly that action applies across your organization.

These scopes are documented as Basic, Local, Deep, and Global. In the Power Platform admin center, the same concepts appear with the following labels:

  • User → Basic: Access only to records the user owns or that are shared with them.
  • Business → Local: Access to records owned by users in the same business unit.
  • Parent: Child Business Unit → Deep: Access to records in the user's business unit and all subordinate business units.
  • Organization → Global: Access to all records across the entire environment, regardless of business unit.

Release-wise changes to roles and privileges

This section is updated after each release to note changes, if any, to out-of-the-box roles and privileges. Each release is documented on its own page:

  • Last updated on