User roles and permissions

What it does

Access to a Customer Insights - Data environment is closed by default and granted per environment by an admin, to a user, a group or an application. The role you assign decides which pages someone sees and what they can change, and it also drives a matching set of Dataverse security roles behind the scenes.

Key facts

Five roles: Viewer, Marketing Contributor, Contributor, Administrator, and Administrator (environment owner). Owner is not a separate assignment — it is the admin who owns the environment.
Marketing Contributor is a preview role and only exists in environments with business units enabled. It scopes profile access to the user's business unit and limits segment and measure creation to "Build your own".
Viewer can browse home, customers, segments, tables, data sources, enrichments, exports and the System page, run searches and export tables. It cannot configure anything.
Contributor adds the build work: data sources, unification, relationships and activities, segments, measures, predictions, first-party enrichments, and exports that use a connection an admin has already shared.
Administrator adds everything under Settings — permissions, connections, API enablement, key vault, private links, the search and filter index, refresh schedules, Copilot consent, and export and enrichment management.
Only the environment owner can reset or delete the environment. An admin cannot.
Each Customer Insights role maps to a fixed set of Dataverse security roles: admins get Administrator, Customizer, Environment Maker, Basic User, Data Read Access and Configuration Viewer; Contributor drops Administrator; Marketing Contributor and Viewer get Basic User, Data Read Access and Configuration Viewer.
Permission changes take up to 15 minutes to propagate, and the user needs to refresh their browser before the UI reflects it.
Assigning someone Administrator gives them System Administrator in the linked Dataverse environment. That is required for managing Power Platform dataflow connections, and it is a much bigger grant than the role name suggests.
Permissions are managed at Settings > Permissions > Users, and adding a user shares the current environment with them automatically. The same page is where application registrations are added as users for server-to-server API access.

When to use / skip

There is no skipping this one — an environment with everyone as Administrator is the default failure mode, and it is worth heading off in the first workshop. The useful framing for a client is that Contributor is the working role for the analytics or CRM team who build segments and measures, Viewer is for the business audience who just want to look, and Administrator should be two or three named people who own the environment rather than everyone who touches it.

Marketing Contributor is worth a look only if the client genuinely runs business units and needs profile access partitioned. It is preview, it is narrow, and the missing capabilities (no customer search, no measures or activities on the customer card) surprise people. For most projects, Contributor with a sensible export policy is the right answer.

Configuration decisions

Which named individuals hold Administrator, and whether they understand that it carries Dataverse System Administrator.
Whether to assign roles to Microsoft Entra groups rather than individuals, so joiners and leavers are handled by the client's existing identity process.
Who owns each environment, and who the standby owner is.
Whether contributors get to create their own export connections (they cannot) or whether admins pre-create and share them.
Whether business units and the Marketing Contributor role are in scope, or profile access stays environment-wide.
Which application registrations need to exist as users for API or Power Platform integration, and who reviews them.

Gotchas

Do not tidy up the Dataverse security roles that Customer Insights assigns. Removing them from a user breaks behaviour in ways that surface as odd permission errors far from the change.
Administrator in Customer Insights means System Administrator in Dataverse. If the client's Dataverse governance is strict, this will be the conversation that delays go-live, so raise it early.
The 15-minute propagation window means "I still can't see it" during a training session is usually not a bug. Say so before the session, not during.
Roles are per environment. Someone added to the sandbox is not added to production, and nobody notices until cutover.
Contributors cannot create connections, so an export they were asked to build will simply have no destination to pick until an admin creates and shares one.
Removing a user from Settings > Permissions is also the documented route for a user-data deletion request, so treat the removal list as a compliance artefact rather than housekeeping.

Consultant notes

Push for group-based assignment on day one. Retrofitting it after two hundred individual grants is nobody's favourite afternoon.
Show the client the role matrix rather than describing it — the page is a table and it ends arguments quickly.
Have the export-connection split explicit in the RACI: admins own destinations and credentials, contributors own payload and frequency.
Before go-live, run the permissions list against the client's leavers process and confirm at least two admins plus a named owner still exist.
Keep a note of which app registrations were added as users and why, because in a year nobody will remember and nobody will dare remove them.

Worth revisiting when Marketing Contributor and business units come out of preview, or if the Dataverse role mappings change.