Almanac

Consultant-focused KB for Microsoft Dynamics 365 Contact Center: implementation notes, gotchas, and configuration decisions beyond the official docs — across voice and digital channels, routing, agent and supervisor experience, Copilot & AI, workforce engagement, analytics, administration and security.

feature-wem-security-roles.mdv1 · history
CurrentApplies to BothUpdated 15 hours agoSource Microsoft Learn

Status: Public Preview — behaviour may change.

What it does

Five dedicated workforce management roles — WFM Administrator, WFM Forecaster, WFM Scheduler, WFM Intraday Analyst and WFM Service Rep — split what used to be granted in one lump by Omnichannel supervisor. Quality management keeps its existing three roles (Quality Admin, Quality Manager, Quality Evaluator). Together they control both access inside the Workforce Engagement Management app and whether that app is visible at all.

Key facts

  • The five WFM roles apply only inside the Workforce Engagement Management app. They don't replace Omnichannel supervisor or Omnichannel agent, and they don't change how those work in Copilot Service workspace. Nothing to migrate.
  • The three quality management roles are not app-scoped — they govern quality management inside and outside the app.
  • Holding any one of the eight roles is what makes the app appear in the user's app list. Within the app, the site map is filtered by the roles held.
  • WFM areas are cleanly separated: Forecaster owns forecast scenarios, capacity plans, operation calendars and external forecast data; Scheduler owns shift plans, auto schedule, break distribution, publishing and bookings; Intraday Analyst owns the adherence tracker, adherence history and both intraday performance views, including export.
  • Scheduler and Intraday Analyst get read on forecast scenarios and capacity plans but can't change them — deliberate, so they can see the plan they're working against.
  • Requests are split by action, not by object: Service Rep raises bids, swaps and time-off requests; Scheduler approves or declines them. Only Service Rep (and Administrator) can accept a swap offer; only Administrator can accept a raised swap offer.
  • Only WFM Administrator can open Admin settings, which includes turning whole capabilities on and off (forecasting, capacity planning, shift-based routing, rotations, bidding, swapping, representative calendar) and setting the swap expiry period.
  • Screen recording privileges are asymmetric: all three quality roles can play recordings back, none of them can create one, and only Quality Admin can download or delete.
  • Roles stack. Forecaster plus Scheduler is the documented pattern for a planner who also builds schedules.
  • Assignment is ordinary Dataverse security role assignment via Power Platform admin centre — the app shows up at the user's next sign-in.

When to use / skip

Use these the moment you have anyone whose job is a subset of workforce management, which is most contact centres above a couple of hundred seats. Skip them where one supervisor genuinely does everything and already holds Omnichannel supervisor — you'd be adding administration for no separation.

Configuration decisions

  • Which of the five roles maps to each real job title. The split is functional, not seniority-based, so an org chart is the wrong starting point — work from who touches forecasts, who publishes schedules, and who watches the day.
  • Whether schedulers should approve time-off, or whether that stays with line management outside the system. Scheduler carries approve/decline on time-off, bids and swaps as one bundle — you can't separate them.
  • Whether to grant Service Rep broadly. It's the self-service role, and it's also an app-visibility key, so granting it widely puts the app in a lot of launchers.
  • Who holds WFM Administrator. It's the only role that can switch capabilities off tenant-wide from inside the app, which is a bigger blast radius than its name suggests.
  • Whether quality management users need the app at all, given their roles have effects outside it.

Gotchas

  • The quality roles' global scope is the main trap. Granting Quality Manager to give someone the app also gives them evaluation criteria, evaluation plans and governance policies in the existing experience.
  • WFM Administrator's admin settings aren't "administer my team" — they're feature toggles. Someone experimenting can turn shift-based routing off for everyone.
  • Forecaster can't read shift plans at all. A planner who expects to sanity-check their capacity plan against the published schedule needs Scheduler or Intraday Analyst as well.
  • Intraday Analyst has no scheduling privileges whatsoever, so the analyst who spots an intraday gap can't fix it — by design, but it surprises people who previously did both as a supervisor.
  • Export is bundled with view on the intraday and adherence reports for Intraday Analyst. If data exfiltration is a concern, that's the role to look at.
  • Preview roles: privilege tables are explicitly "in preview" and are the kind of thing that moves before GA. Don't hard-code a custom role cloned from one of these and assume it stays aligned.

Consultant notes

  • This is the answer to a question clients have raised in every WFM design workshop: "why does my forecaster need supervisor?" Lead with it. It usually unlocks a WFM rollout that had stalled on security objections.
  • The design mistake to watch for is mapping roles to seniority. A team leader isn't automatically a Scheduler, and a manager isn't automatically an Administrator. Map by function or you'll end up granting Administrator to people who only needed to approve time-off.
  • Sequencing matters: get the role mapping agreed before you pilot the app, because the roles are also the app-visibility switch. Clients who assign roles just to "see the app" contaminate the pilot and, with quality roles, change live permissions.
  • Post-go-live, the swap and bid privilege split is where support tickets come from. Representatives can raise a swap and accept one, but only an administrator can accept a raised offer — that asymmetry isn't intuitive and is worth writing into the floor-level guidance rather than leaving to discovery.
  • Audit who already holds Quality Admin before anything else. On most tenants it was granted early and broadly during a quality management trial, and it carries screen recording download and delete.

Worth revisiting after the next release wave — privilege tables are preview and the WFM roles are app-scoped only for now.

Was this accurate?