[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-microsoft-dv-security":3,"mdc--j0wiyk-key":41,"related-repo-microsoft-dv-security":1618,"related-org-microsoft-dv-security":1655},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":36,"sourceUrl":39,"mdContent":40},"dv-security","manage security and access in Dataverse","Security-role assignment, user access, application users, business units, and admin self-elevation in Dataverse environments. Use when the user wants to give someone access, grant a role, become an admin, or add a service principal.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"microsoft","Microsoft","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fmicrosoft.png",[12,16,17,20],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},"Access Control","access-control",{"name":21,"slug":22,"type":15},"Dataverse","dataverse",184,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002FDataverse-skills","2026-07-24T05:41:15.889984",null,48,[29,22,30,31,32,33,34,35],"agent-skills","dynamics-365","dynamics-crm","mcp","mcp-server","plugin","power-platform",{"repoUrl":24,"stars":23,"forks":27,"topics":37,"description":38},[29,22,30,31,32,33,34,35],"Microsoft Dataverse skills for AI coding agents. Wraps the Dataverse MCP server, Dataverse CLI, Python SDK, and PAC CLI behind specialist skills for building, querying, deploying, and administering Dataverse environments.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002FDataverse-skills\u002Ftree\u002FHEAD\u002F.github\u002Fplugins\u002Fdataverse\u002Fskills\u002Fdv-security","---\nname: dv-security\ndescription: Security-role assignment, user access, application users, business units, and admin self-elevation in Dataverse environments. Use when the user wants to give someone access, grant a role, become an admin, or add a service principal.\n---\n\n# Skill: Security — Role Assignment and Self-Elevation\n\n**This skill uses first-party CLIs — PAC CLI for role changes, Dataverse CLI to verify.** Do NOT write Python scripts for role operations.\n\n## Preview Before Running\n\nRole grants and self-elevate are destructive (they change security posture and are logged to Purview). Before running, preview the action in plain prose — target user, role, environment(s) — using placeholders (`\u003CENV_URL>`, `\u003CUSER_EMAIL>`) for anything unknown, and ask for confirmation and missing values in the same turn. Skip the raw `pac admin` block; the user shouldn't have to read CLI syntax to approve a security change.\n\n**Key principle:** the user should be able to evaluate what's about to happen from your first response. A bare *\"which environment?\"* fails that test; a one-line prose preview passes it.\n\n### Examples\n\n**Assign role (user given, env missing):**\n- ❌ \"Which environment should I target?\"\n- ✅ \"I'll assign **System Administrator** to `user@contoso.com` on `\u003CENV_URL>`. Confirm to proceed and provide the target environment URL (or 'all' to list and batch).\"\n\n**Admin access across all environments:**\n- ❌ \"Please provide your email address.\"\n- ✅ \"I'll list your environments, then assign **System Administrator** in parallel on each one for `\u003CYOUR_UPN>`. If `assign-user` fails on any environment, I'll fall back to self-elevate (logged to Purview) for that one. Confirm to proceed and provide your UPN.\"\n\n## Skill boundaries\n\n| Need | Use instead |\n|---|---|\n| Create or modify tables, columns, relationships | **dv-metadata** |\n| Manage org settings, audit, bulk delete, retention | **dv-admin** |\n| Query or read records | **dv-query** |\n| Write, update, or delete records | **dv-data** |\n| Tenant-level governance (DLP, env lifecycle) | `pac admin --help` |\n\n## Prerequisites\n\n- PAC CLI installed and authenticated (`pac auth create`)\n- System Administrator role in target environment (or Global\u002FPP\u002FD365 Admin for self-elevate)\n- Active auth profile: `pac auth list`\n\n---\n\n## Assign a Security Role to a User\n\n```bash\npac admin assign-user --user \u003Cemail-or-object-id> --role \"System Administrator\" --environment \u003Curl>\n```\n\n### Arguments\n\n| Argument | Alias | Required | Description |\n|----------|-------|----------|-------------|\n| `--user` | `-u` | Yes | User email (UPN) or Azure AD object ID |\n| `--role` | `-r` | Yes | Security role name (e.g., `System Administrator`, `Basic User`) |\n| `--environment` | `-env` | Yes | Target environment URL or ID |\n| `--application-user` | `-au` | No | Treat user as an application user (service principal) |\n| `--business-unit` | `-bu` | No | Business unit ID. Defaults to the caller's business unit |\n\n---\n\n## Verify the assignment — exit code 0 is not proof\n\n`pac admin assign-user` **exits 0 even when it fails** (unresolved environment, wrong role name, unknown user). Never treat a clean exit as success.\n\n1. **Read the output, not just the exit code.** A failed run still exits 0 but prints an error (`environment ... not found`, `role ... does not exist`). Stop if the output contains an error.\n2. **Confirm against the exact `--environment` you used** — do not re-resolve or shorten it; a different id silently \"succeeds\" on the wrong org. Query the user's roles with a Dataverse CLI read:\n\n```bash\n# Resolve the user's systemuserid, then list their assigned roles.\n# --context carries plugin\u002Fskill\u002Fagent attribution on the managed CLI call.\ndataverse api request --target dataverse --method GET \\\n  --path \"\u002Fapi\u002Fdata\u002Fv9.2\u002Fsystemusers?%24select=systemuserid&%24filter=internalemailaddress eq 'user@contoso.com'\" \\\n  --environment \u003Csame-url-as-assign> \\\n  --context \"app=dataverse-skills\u002F\u003Cver>;skill=dv-security;agent=\u003Cagent>\"\ndataverse api request --target dataverse --method GET \\\n  --path \"\u002Fapi\u002Fdata\u002Fv9.2\u002Fsystemusers(\u003Csystemuserid>)\u002Fsystemuserroles_association?%24select=name\" \\\n  --environment \u003Csame-url-as-assign> \\\n  --context \"app=dataverse-skills\u002F\u003Cver>;skill=dv-security;agent=\u003Cagent>\"\n```\n\nIf the first query returns no row, the sign-in identity may live on `domainname` (the AAD UPN) rather than `internalemailaddress` (Primary Email) — retry with `%24filter=domainname eq '\u003Cupn>'`, or `azureactivedirectoryobjectid eq '\u003Cobjectid>'` when you assigned by object id. A missing row is not proof the grant failed.\n\nIf the target role is absent, the assignment did not take — re-run, read the output, or fall back to self-elevate.\n\n---\n\n## Batch Workflow: Assign Role Across Multiple Environments\n\nRun in parallel — never sequentially:\n\n```\nStep 1: pac admin list                                              -> Get all environments\nStep 2: Filter by type if needed (e.g., Developer, Sandbox)        -> Identify targets\nStep 3: Confirm with user — show list of target environments\nStep 4: Run ALL assignments in a single bash call:\n```\n\n```bash\npac admin assign-user --user user@contoso.com --role \"System Administrator\" --environment https:\u002F\u002Fdev1.crm.dynamics.com &\npac admin assign-user --user user@contoso.com --role \"System Administrator\" --environment https:\u002F\u002Fdev2.crm.dynamics.com &\npac admin assign-user --user user@contoso.com --role \"System Administrator\" --environment https:\u002F\u002Fdev3.crm.dynamics.com &\nwait\n```\n\n```\nStep 5: Verify each landed (exit 0 is not proof — see above), then report (\"Assigned + verified on 3\u002F3 environments\")\n```\n\n**Important**: Always confirm which environments will be affected before assigning roles, and verify each assignment landed — a clean exit code does not prove success.\n\n---\n\n## Tenant Admin Self-Elevation (Fallback)\n\n**Self-elevation is materially different from assigning a role to another user.** `pac admin assign-user \u003Cother>` grants privilege *to someone else*; `pac admin self-elevate` grants privilege *to the caller*. The risk profile and audit posture are different, so the confirmation protocol is stricter.\n\nIf `pac admin assign-user` fails with \"user has not been assigned any roles\", use:\n\n```bash\npac admin self-elevate --environment https:\u002F\u002Fmyorg.crm.dynamics.com\n```\n\n- Requires Global Admin, Power Platform Admin, or Dynamics 365 Admin\n- All elevations are logged to Microsoft Purview\n- Uses the active auth profile if `--environment` is omitted\n\n### Self-elevation confirmation protocol (stricter than assign-user)\n\nBefore running `pac admin self-elevate`, the agent MUST:\n\n1. **State the risk explicitly.** Include this wording (or equivalent) in the pre-run summary:\n   > \"This grants YOU System Administrator on `\u003Cenv>`. The action is logged to Microsoft Purview with your identity and timestamp.\"\n2. **Capture a reason.** Ask for a one-line reason — ticket ID, incident number, or a free-form note such as `\"dev sandbox access — no ticket\"`. Echo the reason back in the pre-run summary so the user sees what will be on the record.\n3. **Wait for an explicit confirmation AFTER the user has seen both (1) and (2).** Do NOT accept a bare \"yes\" given before the risk statement and reason are on screen.\n4. **Do NOT silently fall back.** If `pac admin assign-user` fails, surface the failure first, then offer `self-elevate` with this protocol — never chain them automatically.\n\n**Flow**: Always try `pac admin assign-user` first. `admin self-elevate` is the documented fallback, gated by the protocol above.\n\n**CLI fallback**: If `pac admin self-elevate` errors out, self-elevate manually via **Power Platform Admin Center** → select the environment → **Access** → **System Administrator role**. All elevations are still logged to Purview. (In PAC CLI 2.6.4 the command fails with `bolt.authentication.http.AuthenticatedClientException` \u002F `ApiVersionInvalid` because the CLI sends an empty `api-version=` to the backend.)\n\n---\n\n## Safety Rules\n\n- **Always confirm** before assigning System Administrator role\n- Show the list of target environments before batch operations\n- Self-elevation is logged and auditable — warn the user\n",{"data":42,"body":43},{"name":4,"description":6},{"type":44,"children":45},"root",[46,55,67,74,104,122,129,137,174,182,217,223,332,338,370,374,380,484,490,687,690,696,714,760,1017,1054,1059,1062,1068,1073,1083,1257,1266,1276,1279,1285,1323,1335,1367,1392,1398,1410,1493,1518,1580,1583,1589,1612],{"type":47,"tag":48,"props":49,"children":51},"element","h1",{"id":50},"skill-security-role-assignment-and-self-elevation",[52],{"type":53,"value":54},"text","Skill: Security — Role Assignment and Self-Elevation",{"type":47,"tag":56,"props":57,"children":58},"p",{},[59,65],{"type":47,"tag":60,"props":61,"children":62},"strong",{},[63],{"type":53,"value":64},"This skill uses first-party CLIs — PAC CLI for role changes, Dataverse CLI to verify.",{"type":53,"value":66}," Do NOT write Python scripts for role operations.",{"type":47,"tag":68,"props":69,"children":71},"h2",{"id":70},"preview-before-running",[72],{"type":53,"value":73},"Preview Before Running",{"type":47,"tag":56,"props":75,"children":76},{},[77,79,86,88,94,96,102],{"type":53,"value":78},"Role grants and self-elevate are destructive (they change security posture and are logged to Purview). Before running, preview the action in plain prose — target user, role, environment(s) — using placeholders (",{"type":47,"tag":80,"props":81,"children":83},"code",{"className":82},[],[84],{"type":53,"value":85},"\u003CENV_URL>",{"type":53,"value":87},", ",{"type":47,"tag":80,"props":89,"children":91},{"className":90},[],[92],{"type":53,"value":93},"\u003CUSER_EMAIL>",{"type":53,"value":95},") for anything unknown, and ask for confirmation and missing values in the same turn. Skip the raw ",{"type":47,"tag":80,"props":97,"children":99},{"className":98},[],[100],{"type":53,"value":101},"pac admin",{"type":53,"value":103}," block; the user shouldn't have to read CLI syntax to approve a security change.",{"type":47,"tag":56,"props":105,"children":106},{},[107,112,114,120],{"type":47,"tag":60,"props":108,"children":109},{},[110],{"type":53,"value":111},"Key principle:",{"type":53,"value":113}," the user should be able to evaluate what's about to happen from your first response. A bare ",{"type":47,"tag":115,"props":116,"children":117},"em",{},[118],{"type":53,"value":119},"\"which environment?\"",{"type":53,"value":121}," fails that test; a one-line prose preview passes it.",{"type":47,"tag":123,"props":124,"children":126},"h3",{"id":125},"examples",[127],{"type":53,"value":128},"Examples",{"type":47,"tag":56,"props":130,"children":131},{},[132],{"type":47,"tag":60,"props":133,"children":134},{},[135],{"type":53,"value":136},"Assign role (user given, env missing):",{"type":47,"tag":138,"props":139,"children":140},"ul",{},[141,147],{"type":47,"tag":142,"props":143,"children":144},"li",{},[145],{"type":53,"value":146},"❌ \"Which environment should I target?\"",{"type":47,"tag":142,"props":148,"children":149},{},[150,152,157,159,165,167,172],{"type":53,"value":151},"✅ \"I'll assign ",{"type":47,"tag":60,"props":153,"children":154},{},[155],{"type":53,"value":156},"System Administrator",{"type":53,"value":158}," to ",{"type":47,"tag":80,"props":160,"children":162},{"className":161},[],[163],{"type":53,"value":164},"user@contoso.com",{"type":53,"value":166}," on ",{"type":47,"tag":80,"props":168,"children":170},{"className":169},[],[171],{"type":53,"value":85},{"type":53,"value":173},". Confirm to proceed and provide the target environment URL (or 'all' to list and batch).\"",{"type":47,"tag":56,"props":175,"children":176},{},[177],{"type":47,"tag":60,"props":178,"children":179},{},[180],{"type":53,"value":181},"Admin access across all environments:",{"type":47,"tag":138,"props":183,"children":184},{},[185,190],{"type":47,"tag":142,"props":186,"children":187},{},[188],{"type":53,"value":189},"❌ \"Please provide your email address.\"",{"type":47,"tag":142,"props":191,"children":192},{},[193,195,199,201,207,209,215],{"type":53,"value":194},"✅ \"I'll list your environments, then assign ",{"type":47,"tag":60,"props":196,"children":197},{},[198],{"type":53,"value":156},{"type":53,"value":200}," in parallel on each one for ",{"type":47,"tag":80,"props":202,"children":204},{"className":203},[],[205],{"type":53,"value":206},"\u003CYOUR_UPN>",{"type":53,"value":208},". If ",{"type":47,"tag":80,"props":210,"children":212},{"className":211},[],[213],{"type":53,"value":214},"assign-user",{"type":53,"value":216}," fails on any environment, I'll fall back to self-elevate (logged to Purview) for that one. Confirm to proceed and provide your UPN.\"",{"type":47,"tag":68,"props":218,"children":220},{"id":219},"skill-boundaries",[221],{"type":53,"value":222},"Skill boundaries",{"type":47,"tag":224,"props":225,"children":226},"table",{},[227,246],{"type":47,"tag":228,"props":229,"children":230},"thead",{},[231],{"type":47,"tag":232,"props":233,"children":234},"tr",{},[235,241],{"type":47,"tag":236,"props":237,"children":238},"th",{},[239],{"type":53,"value":240},"Need",{"type":47,"tag":236,"props":242,"children":243},{},[244],{"type":53,"value":245},"Use instead",{"type":47,"tag":247,"props":248,"children":249},"tbody",{},[250,267,283,299,315],{"type":47,"tag":232,"props":251,"children":252},{},[253,259],{"type":47,"tag":254,"props":255,"children":256},"td",{},[257],{"type":53,"value":258},"Create or modify tables, columns, relationships",{"type":47,"tag":254,"props":260,"children":261},{},[262],{"type":47,"tag":60,"props":263,"children":264},{},[265],{"type":53,"value":266},"dv-metadata",{"type":47,"tag":232,"props":268,"children":269},{},[270,275],{"type":47,"tag":254,"props":271,"children":272},{},[273],{"type":53,"value":274},"Manage org settings, audit, bulk delete, retention",{"type":47,"tag":254,"props":276,"children":277},{},[278],{"type":47,"tag":60,"props":279,"children":280},{},[281],{"type":53,"value":282},"dv-admin",{"type":47,"tag":232,"props":284,"children":285},{},[286,291],{"type":47,"tag":254,"props":287,"children":288},{},[289],{"type":53,"value":290},"Query or read records",{"type":47,"tag":254,"props":292,"children":293},{},[294],{"type":47,"tag":60,"props":295,"children":296},{},[297],{"type":53,"value":298},"dv-query",{"type":47,"tag":232,"props":300,"children":301},{},[302,307],{"type":47,"tag":254,"props":303,"children":304},{},[305],{"type":53,"value":306},"Write, update, or delete records",{"type":47,"tag":254,"props":308,"children":309},{},[310],{"type":47,"tag":60,"props":311,"children":312},{},[313],{"type":53,"value":314},"dv-data",{"type":47,"tag":232,"props":316,"children":317},{},[318,323],{"type":47,"tag":254,"props":319,"children":320},{},[321],{"type":53,"value":322},"Tenant-level governance (DLP, env lifecycle)",{"type":47,"tag":254,"props":324,"children":325},{},[326],{"type":47,"tag":80,"props":327,"children":329},{"className":328},[],[330],{"type":53,"value":331},"pac admin --help",{"type":47,"tag":68,"props":333,"children":335},{"id":334},"prerequisites",[336],{"type":53,"value":337},"Prerequisites",{"type":47,"tag":138,"props":339,"children":340},{},[341,354,359],{"type":47,"tag":142,"props":342,"children":343},{},[344,346,352],{"type":53,"value":345},"PAC CLI installed and authenticated (",{"type":47,"tag":80,"props":347,"children":349},{"className":348},[],[350],{"type":53,"value":351},"pac auth create",{"type":53,"value":353},")",{"type":47,"tag":142,"props":355,"children":356},{},[357],{"type":53,"value":358},"System Administrator role in target environment (or Global\u002FPP\u002FD365 Admin for self-elevate)",{"type":47,"tag":142,"props":360,"children":361},{},[362,364],{"type":53,"value":363},"Active auth profile: ",{"type":47,"tag":80,"props":365,"children":367},{"className":366},[],[368],{"type":53,"value":369},"pac auth list",{"type":47,"tag":371,"props":372,"children":373},"hr",{},[],{"type":47,"tag":68,"props":375,"children":377},{"id":376},"assign-a-security-role-to-a-user",[378],{"type":53,"value":379},"Assign a Security Role to a User",{"type":47,"tag":381,"props":382,"children":387},"pre",{"className":383,"code":384,"language":385,"meta":386,"style":386},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","pac admin assign-user --user \u003Cemail-or-object-id> --role \"System Administrator\" --environment \u003Curl>\n","bash","",[388],{"type":47,"tag":80,"props":389,"children":390},{"__ignoreMap":386},[391],{"type":47,"tag":392,"props":393,"children":396},"span",{"class":394,"line":395},"line",1,[397,403,409,414,419,425,430,436,441,446,451,455,460,465,469,474,479],{"type":47,"tag":392,"props":398,"children":400},{"style":399},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[401],{"type":53,"value":402},"pac",{"type":47,"tag":392,"props":404,"children":406},{"style":405},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[407],{"type":53,"value":408}," admin",{"type":47,"tag":392,"props":410,"children":411},{"style":405},[412],{"type":53,"value":413}," assign-user",{"type":47,"tag":392,"props":415,"children":416},{"style":405},[417],{"type":53,"value":418}," --user",{"type":47,"tag":392,"props":420,"children":422},{"style":421},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[423],{"type":53,"value":424}," \u003C",{"type":47,"tag":392,"props":426,"children":427},{"style":405},[428],{"type":53,"value":429},"email-or-object-i",{"type":47,"tag":392,"props":431,"children":433},{"style":432},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[434],{"type":53,"value":435},"d",{"type":47,"tag":392,"props":437,"children":438},{"style":421},[439],{"type":53,"value":440},">",{"type":47,"tag":392,"props":442,"children":443},{"style":405},[444],{"type":53,"value":445}," --role",{"type":47,"tag":392,"props":447,"children":448},{"style":421},[449],{"type":53,"value":450}," \"",{"type":47,"tag":392,"props":452,"children":453},{"style":405},[454],{"type":53,"value":156},{"type":47,"tag":392,"props":456,"children":457},{"style":421},[458],{"type":53,"value":459},"\"",{"type":47,"tag":392,"props":461,"children":462},{"style":405},[463],{"type":53,"value":464}," --environment",{"type":47,"tag":392,"props":466,"children":467},{"style":421},[468],{"type":53,"value":424},{"type":47,"tag":392,"props":470,"children":471},{"style":405},[472],{"type":53,"value":473},"ur",{"type":47,"tag":392,"props":475,"children":476},{"style":432},[477],{"type":53,"value":478},"l",{"type":47,"tag":392,"props":480,"children":481},{"style":421},[482],{"type":53,"value":483},">\n",{"type":47,"tag":123,"props":485,"children":487},{"id":486},"arguments",[488],{"type":53,"value":489},"Arguments",{"type":47,"tag":224,"props":491,"children":492},{},[493,519],{"type":47,"tag":228,"props":494,"children":495},{},[496],{"type":47,"tag":232,"props":497,"children":498},{},[499,504,509,514],{"type":47,"tag":236,"props":500,"children":501},{},[502],{"type":53,"value":503},"Argument",{"type":47,"tag":236,"props":505,"children":506},{},[507],{"type":53,"value":508},"Alias",{"type":47,"tag":236,"props":510,"children":511},{},[512],{"type":53,"value":513},"Required",{"type":47,"tag":236,"props":515,"children":516},{},[517],{"type":53,"value":518},"Description",{"type":47,"tag":247,"props":520,"children":521},{},[522,553,596,626,657],{"type":47,"tag":232,"props":523,"children":524},{},[525,534,543,548],{"type":47,"tag":254,"props":526,"children":527},{},[528],{"type":47,"tag":80,"props":529,"children":531},{"className":530},[],[532],{"type":53,"value":533},"--user",{"type":47,"tag":254,"props":535,"children":536},{},[537],{"type":47,"tag":80,"props":538,"children":540},{"className":539},[],[541],{"type":53,"value":542},"-u",{"type":47,"tag":254,"props":544,"children":545},{},[546],{"type":53,"value":547},"Yes",{"type":47,"tag":254,"props":549,"children":550},{},[551],{"type":53,"value":552},"User email (UPN) or Azure AD object ID",{"type":47,"tag":232,"props":554,"children":555},{},[556,565,574,578],{"type":47,"tag":254,"props":557,"children":558},{},[559],{"type":47,"tag":80,"props":560,"children":562},{"className":561},[],[563],{"type":53,"value":564},"--role",{"type":47,"tag":254,"props":566,"children":567},{},[568],{"type":47,"tag":80,"props":569,"children":571},{"className":570},[],[572],{"type":53,"value":573},"-r",{"type":47,"tag":254,"props":575,"children":576},{},[577],{"type":53,"value":547},{"type":47,"tag":254,"props":579,"children":580},{},[581,583,588,589,595],{"type":53,"value":582},"Security role name (e.g., ",{"type":47,"tag":80,"props":584,"children":586},{"className":585},[],[587],{"type":53,"value":156},{"type":53,"value":87},{"type":47,"tag":80,"props":590,"children":592},{"className":591},[],[593],{"type":53,"value":594},"Basic User",{"type":53,"value":353},{"type":47,"tag":232,"props":597,"children":598},{},[599,608,617,621],{"type":47,"tag":254,"props":600,"children":601},{},[602],{"type":47,"tag":80,"props":603,"children":605},{"className":604},[],[606],{"type":53,"value":607},"--environment",{"type":47,"tag":254,"props":609,"children":610},{},[611],{"type":47,"tag":80,"props":612,"children":614},{"className":613},[],[615],{"type":53,"value":616},"-env",{"type":47,"tag":254,"props":618,"children":619},{},[620],{"type":53,"value":547},{"type":47,"tag":254,"props":622,"children":623},{},[624],{"type":53,"value":625},"Target environment URL or ID",{"type":47,"tag":232,"props":627,"children":628},{},[629,638,647,652],{"type":47,"tag":254,"props":630,"children":631},{},[632],{"type":47,"tag":80,"props":633,"children":635},{"className":634},[],[636],{"type":53,"value":637},"--application-user",{"type":47,"tag":254,"props":639,"children":640},{},[641],{"type":47,"tag":80,"props":642,"children":644},{"className":643},[],[645],{"type":53,"value":646},"-au",{"type":47,"tag":254,"props":648,"children":649},{},[650],{"type":53,"value":651},"No",{"type":47,"tag":254,"props":653,"children":654},{},[655],{"type":53,"value":656},"Treat user as an application user (service principal)",{"type":47,"tag":232,"props":658,"children":659},{},[660,669,678,682],{"type":47,"tag":254,"props":661,"children":662},{},[663],{"type":47,"tag":80,"props":664,"children":666},{"className":665},[],[667],{"type":53,"value":668},"--business-unit",{"type":47,"tag":254,"props":670,"children":671},{},[672],{"type":47,"tag":80,"props":673,"children":675},{"className":674},[],[676],{"type":53,"value":677},"-bu",{"type":47,"tag":254,"props":679,"children":680},{},[681],{"type":53,"value":651},{"type":47,"tag":254,"props":683,"children":684},{},[685],{"type":53,"value":686},"Business unit ID. Defaults to the caller's business unit",{"type":47,"tag":371,"props":688,"children":689},{},[],{"type":47,"tag":68,"props":691,"children":693},{"id":692},"verify-the-assignment-exit-code-0-is-not-proof",[694],{"type":53,"value":695},"Verify the assignment — exit code 0 is not proof",{"type":47,"tag":56,"props":697,"children":698},{},[699,705,707,712],{"type":47,"tag":80,"props":700,"children":702},{"className":701},[],[703],{"type":53,"value":704},"pac admin assign-user",{"type":53,"value":706}," ",{"type":47,"tag":60,"props":708,"children":709},{},[710],{"type":53,"value":711},"exits 0 even when it fails",{"type":53,"value":713}," (unresolved environment, wrong role name, unknown user). Never treat a clean exit as success.",{"type":47,"tag":715,"props":716,"children":717},"ol",{},[718,743],{"type":47,"tag":142,"props":719,"children":720},{},[721,726,728,734,735,741],{"type":47,"tag":60,"props":722,"children":723},{},[724],{"type":53,"value":725},"Read the output, not just the exit code.",{"type":53,"value":727}," A failed run still exits 0 but prints an error (",{"type":47,"tag":80,"props":729,"children":731},{"className":730},[],[732],{"type":53,"value":733},"environment ... not found",{"type":53,"value":87},{"type":47,"tag":80,"props":736,"children":738},{"className":737},[],[739],{"type":53,"value":740},"role ... does not exist",{"type":53,"value":742},"). Stop if the output contains an error.",{"type":47,"tag":142,"props":744,"children":745},{},[746,758],{"type":47,"tag":60,"props":747,"children":748},{},[749,751,756],{"type":53,"value":750},"Confirm against the exact ",{"type":47,"tag":80,"props":752,"children":754},{"className":753},[],[755],{"type":53,"value":607},{"type":53,"value":757}," you used",{"type":53,"value":759}," — do not re-resolve or shorten it; a different id silently \"succeeds\" on the wrong org. Query the user's roles with a Dataverse CLI read:",{"type":47,"tag":381,"props":761,"children":763},{"className":383,"code":762,"language":385,"meta":386,"style":386},"# Resolve the user's systemuserid, then list their assigned roles.\n# --context carries plugin\u002Fskill\u002Fagent attribution on the managed CLI call.\ndataverse api request --target dataverse --method GET \\\n  --path \"\u002Fapi\u002Fdata\u002Fv9.2\u002Fsystemusers?%24select=systemuserid&%24filter=internalemailaddress eq 'user@contoso.com'\" \\\n  --environment \u003Csame-url-as-assign> \\\n  --context \"app=dataverse-skills\u002F\u003Cver>;skill=dv-security;agent=\u003Cagent>\"\ndataverse api request --target dataverse --method GET \\\n  --path \"\u002Fapi\u002Fdata\u002Fv9.2\u002Fsystemusers(\u003Csystemuserid>)\u002Fsystemuserroles_association?%24select=name\" \\\n  --environment \u003Csame-url-as-assign> \\\n  --context \"app=dataverse-skills\u002F\u003Cver>;skill=dv-security;agent=\u003Cagent>\"\n",[764],{"type":47,"tag":80,"props":765,"children":766},{"__ignoreMap":386},[767,776,785,828,854,885,908,944,969,997],{"type":47,"tag":392,"props":768,"children":769},{"class":394,"line":395},[770],{"type":47,"tag":392,"props":771,"children":773},{"style":772},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[774],{"type":53,"value":775},"# Resolve the user's systemuserid, then list their assigned roles.\n",{"type":47,"tag":392,"props":777,"children":779},{"class":394,"line":778},2,[780],{"type":47,"tag":392,"props":781,"children":782},{"style":772},[783],{"type":53,"value":784},"# --context carries plugin\u002Fskill\u002Fagent attribution on the managed CLI call.\n",{"type":47,"tag":392,"props":786,"children":788},{"class":394,"line":787},3,[789,793,798,803,808,813,818,823],{"type":47,"tag":392,"props":790,"children":791},{"style":399},[792],{"type":53,"value":22},{"type":47,"tag":392,"props":794,"children":795},{"style":405},[796],{"type":53,"value":797}," api",{"type":47,"tag":392,"props":799,"children":800},{"style":405},[801],{"type":53,"value":802}," request",{"type":47,"tag":392,"props":804,"children":805},{"style":405},[806],{"type":53,"value":807}," --target",{"type":47,"tag":392,"props":809,"children":810},{"style":405},[811],{"type":53,"value":812}," dataverse",{"type":47,"tag":392,"props":814,"children":815},{"style":405},[816],{"type":53,"value":817}," --method",{"type":47,"tag":392,"props":819,"children":820},{"style":405},[821],{"type":53,"value":822}," GET",{"type":47,"tag":392,"props":824,"children":825},{"style":432},[826],{"type":53,"value":827}," \\\n",{"type":47,"tag":392,"props":829,"children":831},{"class":394,"line":830},4,[832,837,841,846,850],{"type":47,"tag":392,"props":833,"children":834},{"style":405},[835],{"type":53,"value":836},"  --path",{"type":47,"tag":392,"props":838,"children":839},{"style":421},[840],{"type":53,"value":450},{"type":47,"tag":392,"props":842,"children":843},{"style":405},[844],{"type":53,"value":845},"\u002Fapi\u002Fdata\u002Fv9.2\u002Fsystemusers?%24select=systemuserid&%24filter=internalemailaddress eq 'user@contoso.com'",{"type":47,"tag":392,"props":847,"children":848},{"style":421},[849],{"type":53,"value":459},{"type":47,"tag":392,"props":851,"children":852},{"style":432},[853],{"type":53,"value":827},{"type":47,"tag":392,"props":855,"children":857},{"class":394,"line":856},5,[858,863,867,872,877,881],{"type":47,"tag":392,"props":859,"children":860},{"style":405},[861],{"type":53,"value":862},"  --environment",{"type":47,"tag":392,"props":864,"children":865},{"style":421},[866],{"type":53,"value":424},{"type":47,"tag":392,"props":868,"children":869},{"style":405},[870],{"type":53,"value":871},"same-url-as-assig",{"type":47,"tag":392,"props":873,"children":874},{"style":432},[875],{"type":53,"value":876},"n",{"type":47,"tag":392,"props":878,"children":879},{"style":421},[880],{"type":53,"value":440},{"type":47,"tag":392,"props":882,"children":883},{"style":432},[884],{"type":53,"value":827},{"type":47,"tag":392,"props":886,"children":888},{"class":394,"line":887},6,[889,894,898,903],{"type":47,"tag":392,"props":890,"children":891},{"style":405},[892],{"type":53,"value":893},"  --context",{"type":47,"tag":392,"props":895,"children":896},{"style":421},[897],{"type":53,"value":450},{"type":47,"tag":392,"props":899,"children":900},{"style":405},[901],{"type":53,"value":902},"app=dataverse-skills\u002F\u003Cver>;skill=dv-security;agent=\u003Cagent>",{"type":47,"tag":392,"props":904,"children":905},{"style":421},[906],{"type":53,"value":907},"\"\n",{"type":47,"tag":392,"props":909,"children":911},{"class":394,"line":910},7,[912,916,920,924,928,932,936,940],{"type":47,"tag":392,"props":913,"children":914},{"style":399},[915],{"type":53,"value":22},{"type":47,"tag":392,"props":917,"children":918},{"style":405},[919],{"type":53,"value":797},{"type":47,"tag":392,"props":921,"children":922},{"style":405},[923],{"type":53,"value":802},{"type":47,"tag":392,"props":925,"children":926},{"style":405},[927],{"type":53,"value":807},{"type":47,"tag":392,"props":929,"children":930},{"style":405},[931],{"type":53,"value":812},{"type":47,"tag":392,"props":933,"children":934},{"style":405},[935],{"type":53,"value":817},{"type":47,"tag":392,"props":937,"children":938},{"style":405},[939],{"type":53,"value":822},{"type":47,"tag":392,"props":941,"children":942},{"style":432},[943],{"type":53,"value":827},{"type":47,"tag":392,"props":945,"children":947},{"class":394,"line":946},8,[948,952,956,961,965],{"type":47,"tag":392,"props":949,"children":950},{"style":405},[951],{"type":53,"value":836},{"type":47,"tag":392,"props":953,"children":954},{"style":421},[955],{"type":53,"value":450},{"type":47,"tag":392,"props":957,"children":958},{"style":405},[959],{"type":53,"value":960},"\u002Fapi\u002Fdata\u002Fv9.2\u002Fsystemusers(\u003Csystemuserid>)\u002Fsystemuserroles_association?%24select=name",{"type":47,"tag":392,"props":962,"children":963},{"style":421},[964],{"type":53,"value":459},{"type":47,"tag":392,"props":966,"children":967},{"style":432},[968],{"type":53,"value":827},{"type":47,"tag":392,"props":970,"children":972},{"class":394,"line":971},9,[973,977,981,985,989,993],{"type":47,"tag":392,"props":974,"children":975},{"style":405},[976],{"type":53,"value":862},{"type":47,"tag":392,"props":978,"children":979},{"style":421},[980],{"type":53,"value":424},{"type":47,"tag":392,"props":982,"children":983},{"style":405},[984],{"type":53,"value":871},{"type":47,"tag":392,"props":986,"children":987},{"style":432},[988],{"type":53,"value":876},{"type":47,"tag":392,"props":990,"children":991},{"style":421},[992],{"type":53,"value":440},{"type":47,"tag":392,"props":994,"children":995},{"style":432},[996],{"type":53,"value":827},{"type":47,"tag":392,"props":998,"children":1000},{"class":394,"line":999},10,[1001,1005,1009,1013],{"type":47,"tag":392,"props":1002,"children":1003},{"style":405},[1004],{"type":53,"value":893},{"type":47,"tag":392,"props":1006,"children":1007},{"style":421},[1008],{"type":53,"value":450},{"type":47,"tag":392,"props":1010,"children":1011},{"style":405},[1012],{"type":53,"value":902},{"type":47,"tag":392,"props":1014,"children":1015},{"style":421},[1016],{"type":53,"value":907},{"type":47,"tag":56,"props":1018,"children":1019},{},[1020,1022,1028,1030,1036,1038,1044,1046,1052],{"type":53,"value":1021},"If the first query returns no row, the sign-in identity may live on ",{"type":47,"tag":80,"props":1023,"children":1025},{"className":1024},[],[1026],{"type":53,"value":1027},"domainname",{"type":53,"value":1029}," (the AAD UPN) rather than ",{"type":47,"tag":80,"props":1031,"children":1033},{"className":1032},[],[1034],{"type":53,"value":1035},"internalemailaddress",{"type":53,"value":1037}," (Primary Email) — retry with ",{"type":47,"tag":80,"props":1039,"children":1041},{"className":1040},[],[1042],{"type":53,"value":1043},"%24filter=domainname eq '\u003Cupn>'",{"type":53,"value":1045},", or ",{"type":47,"tag":80,"props":1047,"children":1049},{"className":1048},[],[1050],{"type":53,"value":1051},"azureactivedirectoryobjectid eq '\u003Cobjectid>'",{"type":53,"value":1053}," when you assigned by object id. A missing row is not proof the grant failed.",{"type":47,"tag":56,"props":1055,"children":1056},{},[1057],{"type":53,"value":1058},"If the target role is absent, the assignment did not take — re-run, read the output, or fall back to self-elevate.",{"type":47,"tag":371,"props":1060,"children":1061},{},[],{"type":47,"tag":68,"props":1063,"children":1065},{"id":1064},"batch-workflow-assign-role-across-multiple-environments",[1066],{"type":53,"value":1067},"Batch Workflow: Assign Role Across Multiple Environments",{"type":47,"tag":56,"props":1069,"children":1070},{},[1071],{"type":53,"value":1072},"Run in parallel — never sequentially:",{"type":47,"tag":381,"props":1074,"children":1078},{"className":1075,"code":1077,"language":53},[1076],"language-text","Step 1: pac admin list                                              -> Get all environments\nStep 2: Filter by type if needed (e.g., Developer, Sandbox)        -> Identify targets\nStep 3: Confirm with user — show list of target environments\nStep 4: Run ALL assignments in a single bash call:\n",[1079],{"type":47,"tag":80,"props":1080,"children":1081},{"__ignoreMap":386},[1082],{"type":53,"value":1077},{"type":47,"tag":381,"props":1084,"children":1086},{"className":383,"code":1085,"language":385,"meta":386,"style":386},"pac admin assign-user --user user@contoso.com --role \"System Administrator\" --environment https:\u002F\u002Fdev1.crm.dynamics.com &\npac admin assign-user --user user@contoso.com --role \"System Administrator\" --environment https:\u002F\u002Fdev2.crm.dynamics.com &\npac admin assign-user --user user@contoso.com --role \"System Administrator\" --environment https:\u002F\u002Fdev3.crm.dynamics.com &\nwait\n",[1087],{"type":47,"tag":80,"props":1088,"children":1089},{"__ignoreMap":386},[1090,1144,1196,1248],{"type":47,"tag":392,"props":1091,"children":1092},{"class":394,"line":395},[1093,1097,1101,1105,1109,1114,1118,1122,1126,1130,1134,1139],{"type":47,"tag":392,"props":1094,"children":1095},{"style":399},[1096],{"type":53,"value":402},{"type":47,"tag":392,"props":1098,"children":1099},{"style":405},[1100],{"type":53,"value":408},{"type":47,"tag":392,"props":1102,"children":1103},{"style":405},[1104],{"type":53,"value":413},{"type":47,"tag":392,"props":1106,"children":1107},{"style":405},[1108],{"type":53,"value":418},{"type":47,"tag":392,"props":1110,"children":1111},{"style":405},[1112],{"type":53,"value":1113}," user@contoso.com",{"type":47,"tag":392,"props":1115,"children":1116},{"style":405},[1117],{"type":53,"value":445},{"type":47,"tag":392,"props":1119,"children":1120},{"style":421},[1121],{"type":53,"value":450},{"type":47,"tag":392,"props":1123,"children":1124},{"style":405},[1125],{"type":53,"value":156},{"type":47,"tag":392,"props":1127,"children":1128},{"style":421},[1129],{"type":53,"value":459},{"type":47,"tag":392,"props":1131,"children":1132},{"style":405},[1133],{"type":53,"value":464},{"type":47,"tag":392,"props":1135,"children":1136},{"style":405},[1137],{"type":53,"value":1138}," https:\u002F\u002Fdev1.crm.dynamics.com",{"type":47,"tag":392,"props":1140,"children":1141},{"style":421},[1142],{"type":53,"value":1143}," &\n",{"type":47,"tag":392,"props":1145,"children":1146},{"class":394,"line":778},[1147,1151,1155,1159,1163,1167,1171,1175,1179,1183,1187,1192],{"type":47,"tag":392,"props":1148,"children":1149},{"style":399},[1150],{"type":53,"value":402},{"type":47,"tag":392,"props":1152,"children":1153},{"style":405},[1154],{"type":53,"value":408},{"type":47,"tag":392,"props":1156,"children":1157},{"style":405},[1158],{"type":53,"value":413},{"type":47,"tag":392,"props":1160,"children":1161},{"style":405},[1162],{"type":53,"value":418},{"type":47,"tag":392,"props":1164,"children":1165},{"style":405},[1166],{"type":53,"value":1113},{"type":47,"tag":392,"props":1168,"children":1169},{"style":405},[1170],{"type":53,"value":445},{"type":47,"tag":392,"props":1172,"children":1173},{"style":421},[1174],{"type":53,"value":450},{"type":47,"tag":392,"props":1176,"children":1177},{"style":405},[1178],{"type":53,"value":156},{"type":47,"tag":392,"props":1180,"children":1181},{"style":421},[1182],{"type":53,"value":459},{"type":47,"tag":392,"props":1184,"children":1185},{"style":405},[1186],{"type":53,"value":464},{"type":47,"tag":392,"props":1188,"children":1189},{"style":405},[1190],{"type":53,"value":1191}," https:\u002F\u002Fdev2.crm.dynamics.com",{"type":47,"tag":392,"props":1193,"children":1194},{"style":421},[1195],{"type":53,"value":1143},{"type":47,"tag":392,"props":1197,"children":1198},{"class":394,"line":787},[1199,1203,1207,1211,1215,1219,1223,1227,1231,1235,1239,1244],{"type":47,"tag":392,"props":1200,"children":1201},{"style":399},[1202],{"type":53,"value":402},{"type":47,"tag":392,"props":1204,"children":1205},{"style":405},[1206],{"type":53,"value":408},{"type":47,"tag":392,"props":1208,"children":1209},{"style":405},[1210],{"type":53,"value":413},{"type":47,"tag":392,"props":1212,"children":1213},{"style":405},[1214],{"type":53,"value":418},{"type":47,"tag":392,"props":1216,"children":1217},{"style":405},[1218],{"type":53,"value":1113},{"type":47,"tag":392,"props":1220,"children":1221},{"style":405},[1222],{"type":53,"value":445},{"type":47,"tag":392,"props":1224,"children":1225},{"style":421},[1226],{"type":53,"value":450},{"type":47,"tag":392,"props":1228,"children":1229},{"style":405},[1230],{"type":53,"value":156},{"type":47,"tag":392,"props":1232,"children":1233},{"style":421},[1234],{"type":53,"value":459},{"type":47,"tag":392,"props":1236,"children":1237},{"style":405},[1238],{"type":53,"value":464},{"type":47,"tag":392,"props":1240,"children":1241},{"style":405},[1242],{"type":53,"value":1243}," https:\u002F\u002Fdev3.crm.dynamics.com",{"type":47,"tag":392,"props":1245,"children":1246},{"style":421},[1247],{"type":53,"value":1143},{"type":47,"tag":392,"props":1249,"children":1250},{"class":394,"line":830},[1251],{"type":47,"tag":392,"props":1252,"children":1254},{"style":1253},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[1255],{"type":53,"value":1256},"wait\n",{"type":47,"tag":381,"props":1258,"children":1261},{"className":1259,"code":1260,"language":53},[1076],"Step 5: Verify each landed (exit 0 is not proof — see above), then report (\"Assigned + verified on 3\u002F3 environments\")\n",[1262],{"type":47,"tag":80,"props":1263,"children":1264},{"__ignoreMap":386},[1265],{"type":53,"value":1260},{"type":47,"tag":56,"props":1267,"children":1268},{},[1269,1274],{"type":47,"tag":60,"props":1270,"children":1271},{},[1272],{"type":53,"value":1273},"Important",{"type":53,"value":1275},": Always confirm which environments will be affected before assigning roles, and verify each assignment landed — a clean exit code does not prove success.",{"type":47,"tag":371,"props":1277,"children":1278},{},[],{"type":47,"tag":68,"props":1280,"children":1282},{"id":1281},"tenant-admin-self-elevation-fallback",[1283],{"type":53,"value":1284},"Tenant Admin Self-Elevation (Fallback)",{"type":47,"tag":56,"props":1286,"children":1287},{},[1288,1293,1294,1300,1302,1307,1309,1315,1316,1321],{"type":47,"tag":60,"props":1289,"children":1290},{},[1291],{"type":53,"value":1292},"Self-elevation is materially different from assigning a role to another user.",{"type":53,"value":706},{"type":47,"tag":80,"props":1295,"children":1297},{"className":1296},[],[1298],{"type":53,"value":1299},"pac admin assign-user \u003Cother>",{"type":53,"value":1301}," grants privilege ",{"type":47,"tag":115,"props":1303,"children":1304},{},[1305],{"type":53,"value":1306},"to someone else",{"type":53,"value":1308},"; ",{"type":47,"tag":80,"props":1310,"children":1312},{"className":1311},[],[1313],{"type":53,"value":1314},"pac admin self-elevate",{"type":53,"value":1301},{"type":47,"tag":115,"props":1317,"children":1318},{},[1319],{"type":53,"value":1320},"to the caller",{"type":53,"value":1322},". The risk profile and audit posture are different, so the confirmation protocol is stricter.",{"type":47,"tag":56,"props":1324,"children":1325},{},[1326,1328,1333],{"type":53,"value":1327},"If ",{"type":47,"tag":80,"props":1329,"children":1331},{"className":1330},[],[1332],{"type":53,"value":704},{"type":53,"value":1334}," fails with \"user has not been assigned any roles\", use:",{"type":47,"tag":381,"props":1336,"children":1338},{"className":383,"code":1337,"language":385,"meta":386,"style":386},"pac admin self-elevate --environment https:\u002F\u002Fmyorg.crm.dynamics.com\n",[1339],{"type":47,"tag":80,"props":1340,"children":1341},{"__ignoreMap":386},[1342],{"type":47,"tag":392,"props":1343,"children":1344},{"class":394,"line":395},[1345,1349,1353,1358,1362],{"type":47,"tag":392,"props":1346,"children":1347},{"style":399},[1348],{"type":53,"value":402},{"type":47,"tag":392,"props":1350,"children":1351},{"style":405},[1352],{"type":53,"value":408},{"type":47,"tag":392,"props":1354,"children":1355},{"style":405},[1356],{"type":53,"value":1357}," self-elevate",{"type":47,"tag":392,"props":1359,"children":1360},{"style":405},[1361],{"type":53,"value":464},{"type":47,"tag":392,"props":1363,"children":1364},{"style":405},[1365],{"type":53,"value":1366}," https:\u002F\u002Fmyorg.crm.dynamics.com\n",{"type":47,"tag":138,"props":1368,"children":1369},{},[1370,1375,1380],{"type":47,"tag":142,"props":1371,"children":1372},{},[1373],{"type":53,"value":1374},"Requires Global Admin, Power Platform Admin, or Dynamics 365 Admin",{"type":47,"tag":142,"props":1376,"children":1377},{},[1378],{"type":53,"value":1379},"All elevations are logged to Microsoft Purview",{"type":47,"tag":142,"props":1381,"children":1382},{},[1383,1385,1390],{"type":53,"value":1384},"Uses the active auth profile if ",{"type":47,"tag":80,"props":1386,"children":1388},{"className":1387},[],[1389],{"type":53,"value":607},{"type":53,"value":1391}," is omitted",{"type":47,"tag":123,"props":1393,"children":1395},{"id":1394},"self-elevation-confirmation-protocol-stricter-than-assign-user",[1396],{"type":53,"value":1397},"Self-elevation confirmation protocol (stricter than assign-user)",{"type":47,"tag":56,"props":1399,"children":1400},{},[1401,1403,1408],{"type":53,"value":1402},"Before running ",{"type":47,"tag":80,"props":1404,"children":1406},{"className":1405},[],[1407],{"type":53,"value":1314},{"type":53,"value":1409},", the agent MUST:",{"type":47,"tag":715,"props":1411,"children":1412},{},[1413,1440,1458,1468],{"type":47,"tag":142,"props":1414,"children":1415},{},[1416,1421,1423],{"type":47,"tag":60,"props":1417,"children":1418},{},[1419],{"type":53,"value":1420},"State the risk explicitly.",{"type":53,"value":1422}," Include this wording (or equivalent) in the pre-run summary:\n",{"type":47,"tag":1424,"props":1425,"children":1426},"blockquote",{},[1427],{"type":47,"tag":56,"props":1428,"children":1429},{},[1430,1432,1438],{"type":53,"value":1431},"\"This grants YOU System Administrator on ",{"type":47,"tag":80,"props":1433,"children":1435},{"className":1434},[],[1436],{"type":53,"value":1437},"\u003Cenv>",{"type":53,"value":1439},". The action is logged to Microsoft Purview with your identity and timestamp.\"",{"type":47,"tag":142,"props":1441,"children":1442},{},[1443,1448,1450,1456],{"type":47,"tag":60,"props":1444,"children":1445},{},[1446],{"type":53,"value":1447},"Capture a reason.",{"type":53,"value":1449}," Ask for a one-line reason — ticket ID, incident number, or a free-form note such as ",{"type":47,"tag":80,"props":1451,"children":1453},{"className":1452},[],[1454],{"type":53,"value":1455},"\"dev sandbox access — no ticket\"",{"type":53,"value":1457},". Echo the reason back in the pre-run summary so the user sees what will be on the record.",{"type":47,"tag":142,"props":1459,"children":1460},{},[1461,1466],{"type":47,"tag":60,"props":1462,"children":1463},{},[1464],{"type":53,"value":1465},"Wait for an explicit confirmation AFTER the user has seen both (1) and (2).",{"type":53,"value":1467}," Do NOT accept a bare \"yes\" given before the risk statement and reason are on screen.",{"type":47,"tag":142,"props":1469,"children":1470},{},[1471,1476,1478,1483,1485,1491],{"type":47,"tag":60,"props":1472,"children":1473},{},[1474],{"type":53,"value":1475},"Do NOT silently fall back.",{"type":53,"value":1477}," If ",{"type":47,"tag":80,"props":1479,"children":1481},{"className":1480},[],[1482],{"type":53,"value":704},{"type":53,"value":1484}," fails, surface the failure first, then offer ",{"type":47,"tag":80,"props":1486,"children":1488},{"className":1487},[],[1489],{"type":53,"value":1490},"self-elevate",{"type":53,"value":1492}," with this protocol — never chain them automatically.",{"type":47,"tag":56,"props":1494,"children":1495},{},[1496,1501,1503,1508,1510,1516],{"type":47,"tag":60,"props":1497,"children":1498},{},[1499],{"type":53,"value":1500},"Flow",{"type":53,"value":1502},": Always try ",{"type":47,"tag":80,"props":1504,"children":1506},{"className":1505},[],[1507],{"type":53,"value":704},{"type":53,"value":1509}," first. ",{"type":47,"tag":80,"props":1511,"children":1513},{"className":1512},[],[1514],{"type":53,"value":1515},"admin self-elevate",{"type":53,"value":1517}," is the documented fallback, gated by the protocol above.",{"type":47,"tag":56,"props":1519,"children":1520},{},[1521,1526,1528,1533,1535,1540,1542,1547,1549,1554,1556,1562,1564,1570,1572,1578],{"type":47,"tag":60,"props":1522,"children":1523},{},[1524],{"type":53,"value":1525},"CLI fallback",{"type":53,"value":1527},": If ",{"type":47,"tag":80,"props":1529,"children":1531},{"className":1530},[],[1532],{"type":53,"value":1314},{"type":53,"value":1534}," errors out, self-elevate manually via ",{"type":47,"tag":60,"props":1536,"children":1537},{},[1538],{"type":53,"value":1539},"Power Platform Admin Center",{"type":53,"value":1541}," → select the environment → ",{"type":47,"tag":60,"props":1543,"children":1544},{},[1545],{"type":53,"value":1546},"Access",{"type":53,"value":1548}," → ",{"type":47,"tag":60,"props":1550,"children":1551},{},[1552],{"type":53,"value":1553},"System Administrator role",{"type":53,"value":1555},". All elevations are still logged to Purview. (In PAC CLI 2.6.4 the command fails with ",{"type":47,"tag":80,"props":1557,"children":1559},{"className":1558},[],[1560],{"type":53,"value":1561},"bolt.authentication.http.AuthenticatedClientException",{"type":53,"value":1563}," \u002F ",{"type":47,"tag":80,"props":1565,"children":1567},{"className":1566},[],[1568],{"type":53,"value":1569},"ApiVersionInvalid",{"type":53,"value":1571}," because the CLI sends an empty ",{"type":47,"tag":80,"props":1573,"children":1575},{"className":1574},[],[1576],{"type":53,"value":1577},"api-version=",{"type":53,"value":1579}," to the backend.)",{"type":47,"tag":371,"props":1581,"children":1582},{},[],{"type":47,"tag":68,"props":1584,"children":1586},{"id":1585},"safety-rules",[1587],{"type":53,"value":1588},"Safety Rules",{"type":47,"tag":138,"props":1590,"children":1591},{},[1592,1602,1607],{"type":47,"tag":142,"props":1593,"children":1594},{},[1595,1600],{"type":47,"tag":60,"props":1596,"children":1597},{},[1598],{"type":53,"value":1599},"Always confirm",{"type":53,"value":1601}," before assigning System Administrator role",{"type":47,"tag":142,"props":1603,"children":1604},{},[1605],{"type":53,"value":1606},"Show the list of target environments before batch operations",{"type":47,"tag":142,"props":1608,"children":1609},{},[1610],{"type":53,"value":1611},"Self-elevation is logged and auditable — warn the user",{"type":47,"tag":1613,"props":1614,"children":1615},"style",{},[1616],{"type":53,"value":1617},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1619,"total":787},[1620,1634,1648],{"slug":1621,"name":1621,"fn":1622,"description":1623,"org":1624,"tags":1625,"stars":23,"repoUrl":24,"updatedAt":1633},"dv-connect","connect to Dataverse environments","One-step setup for a Dataverse environment — installs tools, authenticates, registers the MCP server, and writes `.env`. Use when starting a new project, switching environments, fixing authentication, or troubleshooting an MCP connection that won't come up.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1626,1629,1630,1632],{"name":1627,"slug":1628,"type":15},"Configuration","configuration",{"name":21,"slug":22,"type":15},{"name":1631,"slug":32,"type":15},"MCP",{"name":9,"slug":8,"type":15},"2026-07-31T05:54:51.062501",{"slug":1635,"name":1635,"fn":1636,"description":1637,"org":1638,"tags":1639,"stars":23,"repoUrl":24,"updatedAt":1647},"dv-overview","manage Dataverse and Power Platform environments","Foundational cross-cutting context for Dataverse \u002F Power Platform work — scope and the skill map, the tool-capability reference, the safety rules, and the safe change lifecycle. Use when the user mentions Dataverse, Dynamics 365, Power Platform, CRM, or ERP; load this first for orientation. Specialist skills self-route via their own frontmatter triggers.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1640,1641,1642,1645],{"name":21,"slug":22,"type":15},{"name":9,"slug":8,"type":15},{"name":1643,"slug":1644,"type":15},"Operations","operations",{"name":1646,"slug":35,"type":15},"Power Platform","2026-07-31T05:54:50.051254",{"slug":4,"name":4,"fn":5,"description":6,"org":1649,"tags":1650,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1651,1652,1653,1654],{"name":18,"slug":19,"type":15},{"name":21,"slug":22,"type":15},{"name":9,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"items":1656,"total":1847},[1657,1679,1700,1721,1734,1751,1762,1775,1790,1803,1822,1835],{"slug":1658,"name":1658,"fn":1659,"description":1660,"org":1661,"tags":1662,"stars":1676,"repoUrl":1677,"updatedAt":1678},"rushstack-best-practices","manage Rush monorepos with best practices","Provides best practices and guidance for working with Rush monorepos. Use when the user is working in a Rush-based repository, asks about Rush commands (install, update, build, rebuild), needs help with project selection, dependency management, build caching, subspace configuration, or troubleshooting Rush-specific issues.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1663,1666,1669,1670,1673],{"name":1664,"slug":1665,"type":15},"Engineering","engineering",{"name":1667,"slug":1668,"type":15},"Local Development","local-development",{"name":9,"slug":8,"type":15},{"name":1671,"slug":1672,"type":15},"Project Management","project-management",{"name":1674,"slug":1675,"type":15},"Rush","rush",6484,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Frushstack","2026-04-06T18:34:44.965032",{"slug":1680,"name":1680,"fn":1681,"description":1682,"org":1683,"tags":1684,"stars":1697,"repoUrl":1698,"updatedAt":1699},"azure-ai-agents-persistent-dotnet","build AI agents with Azure .NET SDK","Azure AI Agents Persistent SDK for .NET. Low-level SDK for creating and managing AI agents with threads, messages, runs, and tools. Use for agent CRUD, conversation threads, streaming responses, function calling, file search, and code interpreter. Triggers: \"PersistentAgentsClient\", \"persistent agents\", \"agent threads\", \"agent runs\", \"streaming agents\", \"function calling agents .NET\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1685,1688,1691,1694],{"name":1686,"slug":1687,"type":15},".NET","net",{"name":1689,"slug":1690,"type":15},"Agents","agents",{"name":1692,"slug":1693,"type":15},"Azure","azure",{"name":1695,"slug":1696,"type":15},"LLM","llm",2804,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fskills","2026-07-03T16:32:10.297433",{"slug":1701,"name":1701,"fn":1702,"description":1703,"org":1704,"tags":1705,"stars":1697,"repoUrl":1698,"updatedAt":1720},"azure-ai-anomalydetector-java","build anomaly detection applications with Java","Build anomaly detection applications with Azure AI Anomaly Detector SDK for Java. Use when implementing univariate\u002Fmultivariate anomaly detection, time-series analysis, or AI-powered monitoring.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1706,1709,1710,1713,1716,1717],{"name":1707,"slug":1708,"type":15},"Analytics","analytics",{"name":1692,"slug":1693,"type":15},{"name":1711,"slug":1712,"type":15},"Data Analysis","data-analysis",{"name":1714,"slug":1715,"type":15},"Java","java",{"name":9,"slug":8,"type":15},{"name":1718,"slug":1719,"type":15},"Monitoring","monitoring","2026-05-13T06:14:16.261754",{"slug":1722,"name":1722,"fn":1723,"description":1724,"org":1725,"tags":1726,"stars":1697,"repoUrl":1698,"updatedAt":1733},"azure-ai-contentsafety-java","build content moderation applications with Azure AI","Build content moderation applications with Azure AI Content Safety SDK for Java. Use when implementing text\u002Fimage analysis, blocklist management, or harm detection for hate, violence, sexual content, and self-harm.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1727,1730,1731,1732],{"name":1728,"slug":1729,"type":15},"AI Infrastructure","ai-infrastructure",{"name":1692,"slug":1693,"type":15},{"name":1714,"slug":1715,"type":15},{"name":13,"slug":14,"type":15},"2026-07-07T06:53:31.293235",{"slug":1735,"name":1735,"fn":1736,"description":1737,"org":1738,"tags":1739,"stars":1697,"repoUrl":1698,"updatedAt":1750},"azure-ai-contentsafety-py","detect harmful content with Azure AI Content Safety","Azure AI Content Safety SDK for Python. Use for detecting harmful content in text and images with multi-severity classification.\nTriggers: \"azure-ai-contentsafety\", \"ContentSafetyClient\", \"content moderation\", \"harmful content\", \"text analysis\", \"image analysis\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1740,1741,1744,1745,1746,1749],{"name":1692,"slug":1693,"type":15},{"name":1742,"slug":1743,"type":15},"Compliance","compliance",{"name":1695,"slug":1696,"type":15},{"name":9,"slug":8,"type":15},{"name":1747,"slug":1748,"type":15},"Python","python",{"name":13,"slug":14,"type":15},"2026-07-18T05:14:23.017504",{"slug":1752,"name":1752,"fn":1753,"description":1754,"org":1755,"tags":1756,"stars":1697,"repoUrl":1698,"updatedAt":1761},"azure-ai-language-conversations-py","implement conversational language understanding with Python","Implement Conversational Language Understanding (CLU) using the azure-ai-language-conversations Python SDK. Use when working with ConversationAnalysisClient to analyze conversation intent and entities, building NLP features, or integrating language understanding into applications.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1757,1758,1759,1760],{"name":1707,"slug":1708,"type":15},{"name":1692,"slug":1693,"type":15},{"name":1695,"slug":1696,"type":15},{"name":1747,"slug":1748,"type":15},"2026-07-31T05:54:29.068751",{"slug":1763,"name":1763,"fn":1764,"description":1765,"org":1766,"tags":1767,"stars":1697,"repoUrl":1698,"updatedAt":1774},"azure-ai-translation-text-py","translate text using Azure AI services","Azure AI Text Translation SDK for real-time text translation, transliteration, language detection, and dictionary lookup. Use for translating text content in applications.\nTriggers: \"text translation\", \"translator\", \"translate text\", \"transliterate\", \"TextTranslationClient\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1768,1771,1772,1773],{"name":1769,"slug":1770,"type":15},"API Development","api-development",{"name":1692,"slug":1693,"type":15},{"name":9,"slug":8,"type":15},{"name":1747,"slug":1748,"type":15},"2026-07-18T05:14:16.988376",{"slug":1776,"name":1776,"fn":1777,"description":1778,"org":1779,"tags":1780,"stars":1697,"repoUrl":1698,"updatedAt":1789},"azure-ai-vision-imageanalysis-py","analyze images with Azure AI Vision","Azure AI Vision Image Analysis SDK for captions, tags, objects, OCR, people detection, and smart cropping. Use for computer vision and image understanding tasks.\nTriggers: \"image analysis\", \"computer vision\", \"OCR\", \"object detection\", \"ImageAnalysisClient\", \"image caption\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1781,1782,1785,1788],{"name":1692,"slug":1693,"type":15},{"name":1783,"slug":1784,"type":15},"Computer Vision","computer-vision",{"name":1786,"slug":1787,"type":15},"Images","images",{"name":1747,"slug":1748,"type":15},"2026-07-18T05:14:18.007737",{"slug":1791,"name":1791,"fn":1792,"description":1793,"org":1794,"tags":1795,"stars":1697,"repoUrl":1698,"updatedAt":1802},"azure-appconfiguration-java","manage configuration with Azure App Configuration","Azure App Configuration SDK for Java. Centralized application configuration management with key-value settings, feature flags, and snapshots.\nTriggers: \"ConfigurationClient java\", \"app configuration java\", \"feature flag java\", \"configuration setting java\", \"azure config java\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1796,1797,1798,1801],{"name":1692,"slug":1693,"type":15},{"name":1627,"slug":1628,"type":15},{"name":1799,"slug":1800,"type":15},"Feature Flags","feature-flags",{"name":1714,"slug":1715,"type":15},"2026-07-03T16:32:01.278468",{"slug":1804,"name":1804,"fn":1805,"description":1806,"org":1807,"tags":1808,"stars":1697,"repoUrl":1698,"updatedAt":1821},"azure-cosmos-rust","build applications with Azure Cosmos DB","Azure Cosmos DB library for Rust (NoSQL API). Document CRUD, containers, and globally distributed data.\nTriggers: \"cosmos db rust\", \"CosmosClient rust\", \"document crud rust\", \"NoSQL rust\", \"partition key rust\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1809,1812,1815,1818],{"name":1810,"slug":1811,"type":15},"Cosmos DB","cosmos-db",{"name":1813,"slug":1814,"type":15},"Database","database",{"name":1816,"slug":1817,"type":15},"NoSQL","nosql",{"name":1819,"slug":1820,"type":15},"Rust","rust","2026-07-31T05:54:27.021432",{"slug":1823,"name":1823,"fn":1805,"description":1824,"org":1825,"tags":1826,"stars":1697,"repoUrl":1698,"updatedAt":1834},"azure-cosmos-ts","Azure Cosmos DB JavaScript\u002FTypeScript SDK (@azure\u002Fcosmos) for data plane operations. Use for CRUD operations on documents, queries, bulk operations, and container management. Triggers: \"Cosmos DB\", \"@azure\u002Fcosmos\", \"CosmosClient\", \"document CRUD\", \"NoSQL queries\", \"bulk operations\", \"partition key\", \"container.items\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1827,1828,1829,1830,1831],{"name":1810,"slug":1811,"type":15},{"name":1813,"slug":1814,"type":15},{"name":9,"slug":8,"type":15},{"name":1816,"slug":1817,"type":15},{"name":1832,"slug":1833,"type":15},"TypeScript","typescript","2026-07-03T16:31:19.368382",{"slug":1836,"name":1836,"fn":1837,"description":1838,"org":1839,"tags":1840,"stars":1697,"repoUrl":1698,"updatedAt":1846},"azure-data-tables-java","build table storage applications with Java","Build table storage applications with Azure Tables SDK for Java. Use when working with Azure Table Storage or Cosmos DB Table API for NoSQL key-value data, schemaless storage, or structured data at scale.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1841,1842,1843,1844,1845],{"name":1692,"slug":1693,"type":15},{"name":1810,"slug":1811,"type":15},{"name":1813,"slug":1814,"type":15},{"name":1714,"slug":1715,"type":15},{"name":1816,"slug":1817,"type":15},"2026-05-13T06:14:17.582229",267]